expressjs/cookie-parser — pull request #11 by fishbar (2014-08-21 13:49:11+00:00)
Title: set secret default to be an empty string

secret should have an default string value, because in `cookie-signature`:
```
exports.unsign = function(val, secret){
if ('string' != typeof val) throw new TypeError('cookie required');
if ('string' != typeof secret) throw new TypeError('secret required');
```
it will throw err when secret is not string

a real case:

domain.com have 2 website: A & B
when site A set an signed cookie `sid` , and user visited site B which didn't set secret (no login needed, but parse cookie), it will throw exception;