Ticket #8895: http_cookies.2.patch
| File http_cookies.2.patch, 4.8 kB (added by Spakman, 1 year ago) |
|---|
-
actionpack/test/controller/cookie_test.rb
old new 36 36 render_text "hello world" 37 37 end 38 38 39 def authenticate_with_http_only 40 cookies["user_name"] = { :value => "david", :http_only => true } 41 end 42 39 43 def rescue_action(e) 40 44 raise unless ActionController::MissingTemplate # No templates here, and we don't care about the output 41 45 end … … 69 73 assert_equal [ CGI::Cookie::new("name" => "user_name", "value" => "david", "expires" => Time.local(2005, 10, 10)) ], @response.headers["cookie"] 70 74 end 71 75 76 def test_setting_cookie_with_http_only 77 get :authenticate_with_http_only 78 assert_equal [ CGI::Cookie::new("name" => "user_name", "value" => "david", "http_only" => true) ], @response.headers["cookie"] 79 assert_equal CGI::Cookie::new("name" => "user_name", "value" => "david", "path" => "/", "http_only" => true).to_s, @response.headers["cookie"].to_s 80 end 81 72 82 def test_multiple_cookies 73 83 get :set_multiple_cookies 74 84 assert_equal 2, @response.cookies.size -
actionpack/lib/action_controller/cgi_ext/cookie.rb
old new 19 19 # secure:: whether this cookie is a secure cookie or not (default to 20 20 # false). Secure cookies are only transmitted to HTTPS 21 21 # servers. 22 # 22 # http_only:: whether this cookie can be accessed by client side scripts (e.g. document.cookie) or only over HTTP 23 # More details: http://msdn2.microsoft.com/en-us/library/system.web.httpcookie.httponly.aspx 24 # Defaults to false. 23 25 # These keywords correspond to attributes of the cookie object. 24 26 def initialize(name = '', *value) 25 27 if name.kind_of?(String) … … 28 30 @domain = nil 29 31 @expires = nil 30 32 @secure = false 33 @http_only = false 31 34 @path = nil 32 35 else 33 36 @name = name['name'] … … 35 38 @domain = name['domain'] 36 39 @expires = name['expires'] 37 40 @secure = name['secure'] || false 41 @http_only = name['http_only'] || false 38 42 @path = name['path'] 39 43 end 40 44 … … 56 60 end 57 61 58 62 attr_accessor("name", "value", "path", "domain", "expires") 59 attr_reader("secure" )63 attr_reader("secure", "http_only") 60 64 61 65 # Set whether the Cookie is a secure cookie or not. 62 66 # 63 67 # +val+ must be a boolean. 64 68 def secure=(val) 65 69 @secure = val if val == true or val == false 66 @secure67 70 end 68 71 72 # Set whether the Cookie is a HTTP only or not. 73 # 74 # +val+ must be a boolean. 75 def http_only=(val) 76 @http_only = val if val == true or val == false 77 end 78 69 79 # Convert the Cookie to its string representation. 70 80 def to_s 71 buf = ""81 buf = '' 72 82 buf << @name << '=' 73 74 if @value.kind_of?(String) 75 buf << CGI::escape(@value) 76 else 77 buf << @value.collect{|v| CGI::escape(v) }.join("&") 78 end 79 80 if @domain 81 buf << '; domain=' << @domain 82 end 83 84 if @path 85 buf << '; path=' << @path 86 end 87 88 if @expires 89 buf << '; expires=' << CGI::rfc1123_date(@expires) 90 end 91 92 if @secure == true 93 buf << '; secure' 94 end 95 96 buf 83 buf << (@value.kind_of?(String) ? CGI::escape(@value) : @value.collect{|v| CGI::escape(v) }.join("&")) 84 buf << '; domain=' << @domain if @domain 85 buf << '; path=' << @path if @path 86 buf << '; expires=' << CGI::rfc1123_date(@expires) if @expires 87 buf << '; secure' if @secure 88 buf << '; HttpOnly' if @http_only 97 89 end 98 90 99 91 # Parse a raw cookie string into a hash of cookie-name=>Cookie -
actionpack/lib/action_controller/cookies.rb
old new 23 23 # * <tt>domain</tt> - the domain for which this cookie applies. 24 24 # * <tt>expires</tt> - the time at which this cookie expires, as a +Time+ object. 25 25 # * <tt>secure</tt> - whether this cookie is a secure cookie or not (default to false). 26 # Secure cookies are only transmitted to HTTPS servers. 26 # Secure cookies are only transmitted to HTTPS servers. 27 # * <tt>http_only</tt> - whether this cookie is accessible via scripting or only HTTP (defaults to false). 28 27 29 module Cookies 28 30 protected 29 31 # Returns the cookie container, which operates as described above.
