JavaScript函数按参数执行逻辑及setCookies参数防御方案问询

Great question! Let’s tackle both parts of your problem: making the function behave conditionally based on input parameters, and hardening it against invalid or missing arguments.

Handling Conditional Logic Based on Parameters #

Your current function already uses ternary operators to branch logic based on code and profile, which works—but we can make it more readable and maintainable with modern JavaScript features:

• For state, instead of code ? code : uuid.new(), use the nullish coalescing operator (??) which only falls back when code is null or undefined (not empty strings or falsy values like 0):

  const state = code ?? uuid.v4(); // Assuming your uuid library uses v4 for new IDs
  

• For redirectCookie, replace the ternary with a more explicit conditional + template literal to avoid messy string concatenation:

  let redirectCookie = redirectUri;
  if (profile) {
    redirectCookie = `${redirectUri}?profile=${profile}`;
  }
  

This makes the branching logic clearer, especially if you later need to add more conditions (like validating profile before using it).

Defending Against Parameter Exceptions #

Your function relies heavily on parameters being valid—here’s how to add defensive checks to avoid silent failures or bugs:

1. Validate Required Parameters First #

Parameters like redirectUri and response are critical (you can’t set cookies without response.config). Add explicit checks at the top of the function to fail fast:

if (typeof redirectUri !== 'string' || redirectUri.trim() === '') {
  throw new TypeError('redirectUri must be a non-empty string');
}
if (!response || typeof response.config !== 'object') {
  throw new TypeError('response must be an object with a "config" property');
}

Throwing specific errors helps debug issues quickly instead of letting the function crash later with a vague "cannot read property 'config' of undefined" message.

2. Sanitize Optional Parameters #

Optional parameters like code and profile can be invalid even if they’re passed:

• For code: Ensure it’s a string if provided (avoid numbers or objects being passed accidentally):

  const state = (typeof code === 'string' && code.trim() !== '') ? code : uuid.v4();
  

• For profile: URL-encode it to prevent URL injection attacks (e.g., if profile contains & or =, it could break the redirect URL):

  if (typeof profile === 'string' && profile.trim() !== '') {
    const sanitizedProfile = encodeURIComponent(profile.trim());
    redirectCookie = `${redirectUri}?profile=${sanitizedProfile}`;
  }
  

3. Defensive Property Access #

Even if response is valid, response.config might be missing or invalid. Use optional chaining (?.) and nullish coalescing to fall back safely:

const cookieConfig = response?.config ?? {};

This ensures cookies.set always gets an object (even an empty one) instead of throwing an error.

4. Use Default Parameters (Optional) #

If you want to set default values for optional parameters upfront, you can define them in the function signature:

setCookies: function (redirectUri, code = undefined, profile = undefined, response) {
  // ... rest of the logic
}

This makes it clear which parameters are optional without relying on implicit undefined values.

Full Hardened Example #

Putting it all together, here’s your function with defensive checks and cleaner conditional logic:

setCookies: function (redirectUri, code, profile, response) {
  // Validate required params
  if (typeof redirectUri !== 'string' || redirectUri.trim() === '') {
    throw new TypeError('redirectUri must be a non-empty string');
  }
  if (!response || typeof response.config !== 'object') {
    throw new TypeError('response must be an object with a "config" property');
  }

  // Handle state with validation
  const state = (typeof code === 'string' && code.trim() !== '') ? code : uuid.v4();

  // Build sanitized redirect cookie
  let redirectCookie = redirectUri;
  if (typeof profile === 'string' && profile.trim() !== '') {
    const sanitizedProfile = encodeURIComponent(profile.trim());
    redirectCookie = `${redirectUri}?profile=${sanitizedProfile}`;
  }

  // Safe config access
  const cookieConfig = response?.config ?? {};

  // Set cookies
  cookies.set(names.state, state, cookieConfig);
  cookies.set(names.redirectUri, redirectCookie, cookieConfig);
}

Bonus: TypeScript for Compile-Time Safety #

If you’re using TypeScript, you can enforce parameter types at compile time to catch issues early:

interface CookieConfig {
  // Define the shape of your cookie config here
  expires?: Date;
  path?: string;
}

interface SetCookiesArgs {
  redirectUri: string;
  code?: string;
  profile?: string;
  response: { config: CookieConfig };
}

const setCookies = ({ redirectUri, code, profile, response }: SetCookiesArgs) => {
  // Most runtime checks are no longer needed—TypeScript ensures types are valid
  const state = code ?? uuid.v4();
  let redirectCookie = redirectUri;
  if (profile) {
    redirectCookie = `${redirectUri}?profile=${encodeURIComponent(profile)}`;
  }
  cookies.set(names.state, state, response.config);
  cookies.set(names.redirectUri, redirectCookie, response.config);
};

The key takeaway is to fail fast with clear errors, sanitize all user-provided input, and avoid implicit assumptions about parameter types or values. This makes your function robust and easier to debug when things go wrong.

内容的提问来源于stack exchange，提问作者User 5842