Skip to content
This repository was archived by the owner on Jan 30, 2020. It is now read-only.

Commit 0d99103

Browse files
michalbundyramichalbundyra
committed
Merge branch 'feature/186' into develop
Close #186 Close #174
2 parents b8c93fa + 6941b42 commit 0d99103

File tree

4 files changed

+150
-2
lines changed

4 files changed

+150
-2
lines changed

‎CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ All notable changes to this project will be documented in this file, in reverse
1616

1717
- [#177](https://github.com/zendframework/zend-http/pull/177) adds support for Feature Policy header.
1818

19+
- [#186](https://github.com/zendframework/zend-http/pull/186) adds support for SameSite directive in Set-Cookie header.
20+
1921
### Changed
2022

2123
- [#194](https://github.com/zendframework/zend-http/pull/194) changes range of valid HTTP status codes to 100-599 (inclusive).

‎docs/book/headers.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -455,6 +455,8 @@ Method signature | Descript
455455
`setSecure(bool $secure) : self` | Set whether the cookies contain the Secure flag.
456456
`isHttponly() : bool` | Whether the cookies can be accessed via the HTTP protocol only.
457457
`setHttponly(bool $httponly) : self` | Set whether the cookies can be accessed only via HTTP protocol.
458+
`getSameSite() : ?string` | Retrieve the SameSite directive value (`null` when it is not set).
459+
`setSameSite(?string $sameSite) : self` | Set SameSite directive value - allowed values are: `Strict`, `Lax` and `None`.
458460
`isExpired() : bool` | Whether the cookie is expired.
459461
`isSessionCookie() : bool` | Whether the cookie is a session cookie.
460462
`setQuoteFieldValue(bool $quotedValue) : self` | Set whether the value for this cookie should be quoted.

‎src/Header/SetCookie.php

Lines changed: 70 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,33 @@
1717
*/
1818
class SetCookie implements MultipleHeaderInterface
1919
{
20+
/**
21+
* Cookie will not be sent for any cross-domain requests whatsoever.
22+
* Even if the user simply navigates to the target site with a regular link, the cookie will not be sent.
23+
*/
24+
const SAME_SITE_STRICT = 'Strict';
25+
26+
/**
27+
* Cookie will not be passed for any cross-domain requests unless it's a regular link that navigates user
28+
* to the target site.
29+
* Other requests methods (such as POST and PUT) and XHR requests will not contain this cookie.
30+
*/
31+
const SAME_SITE_LAX = 'Lax';
32+
33+
/**
34+
* Cookie will be sent with same-site and cross-site requests.
35+
*/
36+
const SAME_SITE_NONE = 'None';
37+
38+
/**
39+
* @internal
40+
*/
41+
const SAME_SITE_ALLOWED_VALUES = [
42+
self::SAME_SITE_STRICT,
43+
self::SAME_SITE_LAX,
44+
self::SAME_SITE_NONE,
45+
];
46+
2047
/**
2148
* Cookie name
2249
*
@@ -85,6 +112,11 @@ class SetCookie implements MultipleHeaderInterface
85112
*/
86113
protected $httponly;
87114

115+
/**
116+
* @var string|null
117+
*/
118+
protected $sameSite;
119+
88120
/**
89121
* @var bool
90122
*/
@@ -152,6 +184,9 @@ public static function fromString($headerLine, $bypassHeaderFieldName = false)
152184
case 'maxage':
153185
$header->setMaxAge($headerValue);
154186
break;
187+
case 'samesite':
188+
$header->setSameSite($headerValue);
189+
break;
155190
default:
156191
// Intentionally omitted
157192
}
@@ -199,6 +234,7 @@ public static function fromString($headerLine, $bypassHeaderFieldName = false)
199234
* @param bool $httponly
200235
* @param int|null $maxAge
201236
* @param int|null $version
237+
* @param string|null $sameSite
202238
*/
203239
public function __construct(
204240
$name = null,
@@ -209,7 +245,8 @@ public function __construct(
209245
$secure = false,
210246
$httponly = false,
211247
$maxAge = null,
212-
$version = null
248+
$version = null,
249+
$sameSite = null
213250
) {
214251
$this->type = 'Cookie';
215252

@@ -221,7 +258,8 @@ public function __construct(
221258
->setExpires($expires)
222259
->setPath($path)
223260
->setSecure($secure)
224-
->setHttpOnly($httponly);
261+
->setHttpOnly($httponly)
262+
->setSameSite($sameSite);
225263
}
226264

227265
/**
@@ -298,6 +336,11 @@ public function getFieldValue()
298336
$fieldValue .= '; HttpOnly';
299337
}
300338

339+
$sameSite = $this->getSameSite();
340+
if ($sameSite !== null && in_array($sameSite, self::SAME_SITE_ALLOWED_VALUES, true)) {
341+
$fieldValue .= '; SameSite=' . $sameSite;
342+
}
343+
301344
return $fieldValue;
302345
}
303346

@@ -560,6 +603,31 @@ public function isSessionCookie()
560603
return ($this->expires === null);
561604
}
562605

606+
/**
607+
* @return string|null
608+
*/
609+
public function getSameSite()
610+
{
611+
return $this->sameSite;
612+
}
613+
614+
/**
615+
* @param string|null $sameSite
616+
* @return $this
617+
* @throws Exception\InvalidArgumentException
618+
*/
619+
public function setSameSite($sameSite)
620+
{
621+
if ($sameSite !== null && ! in_array($sameSite, self::SAME_SITE_ALLOWED_VALUES, true)) {
622+
throw new Exception\InvalidArgumentException(sprintf(
623+
'Invalid value provided for SameSite directive: "%s"; expected one of: Strict, Lax or None',
624+
is_scalar($sameSite) ? $sameSite : gettype($sameSite)
625+
));
626+
}
627+
$this->sameSite = $sameSite;
628+
return $this;
629+
}
630+
563631
/**
564632
* Check whether the value for this cookie should be quoted
565633
*

‎test/Header/SetCookieTest.php

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,68 @@ public function testSetCookieConstructor()
4343
$this->assertEquals(9, $setCookieHeader->getVersion());
4444
}
4545

46+
public function testSetCookieConstructorWithSameSite()
47+
{
48+
$setCookieHeader = new SetCookie(
49+
'myname',
50+
'myvalue',
51+
'Wed, 13-Jan-2021 22:23:01 GMT',
52+
'/accounts',
53+
'docs.foo.com',
54+
true,
55+
true,
56+
99,
57+
9,
58+
SetCookie::SAME_SITE_STRICT
59+
);
60+
$this->assertEquals('myname', $setCookieHeader->getName());
61+
$this->assertEquals('myvalue', $setCookieHeader->getValue());
62+
$this->assertEquals('Wed, 13-Jan-2021 22:23:01 GMT', $setCookieHeader->getExpires());
63+
$this->assertEquals('/accounts', $setCookieHeader->getPath());
64+
$this->assertEquals('docs.foo.com', $setCookieHeader->getDomain());
65+
$this->assertTrue($setCookieHeader->isSecure());
66+
$this->assertTrue($setCookieHeader->isHttpOnly());
67+
$this->assertEquals(99, $setCookieHeader->getMaxAge());
68+
$this->assertEquals(9, $setCookieHeader->getVersion());
69+
$this->assertEquals('Strict', $setCookieHeader->getSameSite());
70+
}
71+
72+
public function testSetCookieWithInvalidSameSiteValueThrowException()
73+
{
74+
$this->expectException(InvalidArgumentException::class);
75+
76+
new SetCookie(
77+
'myname',
78+
'myvalue',
79+
'Wed, 13-Jan-2021 22:23:01 GMT',
80+
'/accounts',
81+
'docs.foo.com',
82+
true,
83+
true,
84+
99,
85+
9,
86+
'InvalidValue'
87+
);
88+
}
89+
90+
public function testSetInvalidSameSiteDirectiveValueViaSetter()
91+
{
92+
$setCookieHeader = new SetCookie(
93+
'myname',
94+
'myvalue',
95+
'Wed, 13-Jan-2021 22:23:01 GMT',
96+
'/accounts',
97+
'docs.foo.com',
98+
true,
99+
true,
100+
99,
101+
9
102+
);
103+
104+
$this->expectException(InvalidArgumentException::class);
105+
$setCookieHeader->setSameSite('InvalidValue');
106+
}
107+
46108
public function testSetCookieFromStringWithQuotedValue()
47109
{
48110
$setCookieHeader = SetCookie::fromString('Set-Cookie: myname="quotedValue"');
@@ -85,6 +147,20 @@ public function testSetCookieFromStringCanCreateSingleHeader()
85147
$this->assertEquals('Wed, 13-Jan-2021 22:23:01 GMT', $setCookieHeader->getExpires());
86148
$this->assertTrue($setCookieHeader->isSecure());
87149
$this->assertTrue($setCookieHeader->isHttponly());
150+
151+
$setCookieHeader = SetCookie::fromString(
152+
'set-cookie: myname=myvalue; Domain=docs.foo.com; Path=/accounts;'
153+
. 'Expires=Wed, 13-Jan-2021 22:23:01 GMT; Secure; HttpOnly; SameSite=Strict'
154+
);
155+
$this->assertInstanceOf(MultipleHeaderInterface::class, $setCookieHeader);
156+
$this->assertEquals('myname', $setCookieHeader->getName());
157+
$this->assertEquals('myvalue', $setCookieHeader->getValue());
158+
$this->assertEquals('docs.foo.com', $setCookieHeader->getDomain());
159+
$this->assertEquals('/accounts', $setCookieHeader->getPath());
160+
$this->assertEquals('Wed, 13-Jan-2021 22:23:01 GMT', $setCookieHeader->getExpires());
161+
$this->assertTrue($setCookieHeader->isSecure());
162+
$this->assertTrue($setCookieHeader->isHttponly());
163+
$this->assertEquals(setCookie::SAME_SITE_STRICT, $setCookieHeader->getSameSite());
88164
}
89165

90166
public function testSetCookieFromStringCanCreateMultipleHeaders()

0 commit comments

Comments
 (0)