feat(cloudflare-access): Add support to read JWT from Cookie (#1001)

.changeset/sixty-geese-knock.md

@@ -0,0 +1,5 @@
+---
+'@hono/cloudflare-access': minor
+---
+
+Add support to read JWT from Cookie

packages/cloudflare-access/src/index.test.ts

@@ -229,6 +229,22 @@ describe('Cloudflare Access middleware', async () => {
     expect(await res.text()).toBe('foo')
   })
 
+  it('Should work when sending jwt as a Cookie', async () => {
+    const token = generateJWT(keyPair1.privateKey, {
+      sub: '1234567890',
+      iss: 'https://my-cool-team-name.cloudflareaccess.com',
+    })
+
+    const res = await app.request('http://localhost/hello-behind-access', {
+      headers: {
+        Cookie: `CF_Authorization=${token}`,
+      },
+    })
+    expect(res).not.toBeNull()
+    expect(res.status).toBe(200)
+    expect(await res.text()).toBe('foo')
+  })
+
   it('Should work with tokens signed by the 2º key in the public keys list', async () => {
     const token = generateJWT(keyPair2.privateKey, {
       sub: '1234567890',
@@ -279,7 +295,7 @@ describe('Cloudflare Access middleware', async () => {
     expect(res).not.toBeNull()
     expect(res.status).toBe(500)
     expect(await res.json()).toEqual({
-      err: 'Error: Authentication error: The Access Organization \'my-cool-team-name\' does not exist',
+      err: "Error: Authentication error: The Access Organization 'my-cool-team-name' does not exist",
     })
   })
 

packages/cloudflare-access/src/index.ts

@@ -1,4 +1,5 @@
 import type { Context } from 'hono'
+import { getCookie } from 'hono/cookie';
 import { createMiddleware } from 'hono/factory'
 import { HTTPException } from 'hono/http-exception'
 
@@ -133,11 +134,11 @@ async function getPublicKeys(accessTeamName: string) {
 }
 
 function getJwt(c: Context) {
-  const authHeader = c.req.header('cf-access-jwt-assertion')
-  if (!authHeader) {
+  const jwt = c.req.header('cf-access-jwt-assertion') ?? getCookie(c, 'CF_Authorization')
+  if (!jwt) {
     return null
   }
-  return authHeader.trim()
+  return jwt.trim()
 }
 
 function decodeJwt(token: string): DecodedToken {