Ticket #8895: http_cookies.3.patch
| File http_cookies.3.patch, 5.3 kB (added by Spakman, 1 year ago) |
|---|
-
actionpack/test/controller/cookie_test.rb
old new 36 36 render_text "hello world" 37 37 end 38 38 39 def authenticate_with_http_only 40 cookies["user_name"] = { :value => "david", :http_only => true } 41 end 42 39 43 def rescue_action(e) 40 44 raise unless ActionController::MissingTemplate # No templates here, and we don't care about the output 41 45 end … … 69 73 assert_equal [ CGI::Cookie::new("name" => "user_name", "value" => "david", "expires" => Time.local(2005, 10, 10)) ], @response.headers["cookie"] 70 74 end 71 75 76 def test_setting_cookie_with_http_only 77 get :authenticate_with_http_only 78 assert_equal [ CGI::Cookie::new("name" => "user_name", "value" => "david", "http_only" => true) ], @response.headers["cookie"] 79 assert_equal CGI::Cookie::new("name" => "user_name", "value" => "david", "path" => "/", "http_only" => true).to_s, @response.headers["cookie"].to_s 80 end 81 72 82 def test_multiple_cookies 73 83 get :set_multiple_cookies 74 84 assert_equal 2, @response.cookies.size -
actionpack/lib/action_controller/cgi_ext/cookie.rb
old new 3 3 # TODO: document how this differs from stdlib CGI::Cookie 4 4 class CGI #:nodoc: 5 5 class Cookie < DelegateClass(Array) 6 attr_accessor :name, :value, :path, :domain, :expires 7 attr_reader :secure, :http_only 8 6 9 # Create a new CGI::Cookie object. 7 10 # 8 11 # The contents of the cookie can be specified as a +name+ and one … … 19 22 # secure:: whether this cookie is a secure cookie or not (default to 20 23 # false). Secure cookies are only transmitted to HTTPS 21 24 # servers. 22 # 25 # http_only:: whether this cookie can be accessed by client side scripts (e.g. document.cookie) or only over HTTP 26 # More details: http://msdn2.microsoft.com/en-us/library/system.web.httpcookie.httponly.aspx 27 # Defaults to false. 23 28 # These keywords correspond to attributes of the cookie object. 24 29 def initialize(name = '', *value) 25 30 if name.kind_of?(String) … … 28 33 @domain = nil 29 34 @expires = nil 30 35 @secure = false 36 @http_only = false 31 37 @path = nil 32 38 else 33 39 @name = name['name'] … … 35 41 @domain = name['domain'] 36 42 @expires = name['expires'] 37 43 @secure = name['secure'] || false 44 @http_only = name['http_only'] || false 38 45 @path = name['path'] 39 46 end 40 47 41 unless @name 42 raise ArgumentError, "`name' required" 43 end 48 raise ArgumentError, "`name' required" unless @name 44 49 45 50 # simple support for IE 46 51 unless @path … … 55 60 @_dc_obj = obj 56 61 end 57 62 58 attr_accessor("name", "value", "path", "domain", "expires")59 attr_reader("secure")60 61 63 # Set whether the Cookie is a secure cookie or not. 62 #63 # +val+ must be a boolean.64 64 def secure=(val) 65 @secure = val if val == true or val == false 66 @secure 65 @secure = val == true 67 66 end 68 67 68 # Set whether the Cookie is an HTTP only cookie or not. 69 def http_only=(val) 70 @http_only = val == true 71 end 72 69 73 # Convert the Cookie to its string representation. 70 74 def to_s 71 buf = ""75 buf = '' 72 76 buf << @name << '=' 73 74 if @value.kind_of?(String) 75 buf << CGI::escape(@value) 76 else 77 buf << @value.collect{|v| CGI::escape(v) }.join("&") 78 end 79 80 if @domain 81 buf << '; domain=' << @domain 82 end 83 84 if @path 85 buf << '; path=' << @path 86 end 87 88 if @expires 89 buf << '; expires=' << CGI::rfc1123_date(@expires) 90 end 91 92 if @secure == true 93 buf << '; secure' 94 end 95 96 buf 77 buf << (@value.kind_of?(String) ? CGI::escape(@value) : @value.collect{|v| CGI::escape(v) }.join("&")) 78 buf << '; domain=' << @domain if @domain 79 buf << '; path=' << @path if @path 80 buf << '; expires=' << CGI::rfc1123_date(@expires) if @expires 81 buf << '; secure' if @secure 82 buf << '; HttpOnly' if @http_only 97 83 end 98 84 99 85 # Parse a raw cookie string into a hash of cookie-name=>Cookie -
actionpack/lib/action_controller/cookies.rb
old new 23 23 # * <tt>domain</tt> - the domain for which this cookie applies. 24 24 # * <tt>expires</tt> - the time at which this cookie expires, as a +Time+ object. 25 25 # * <tt>secure</tt> - whether this cookie is a secure cookie or not (default to false). 26 # Secure cookies are only transmitted to HTTPS servers. 26 # Secure cookies are only transmitted to HTTPS servers. 27 # * <tt>http_only</tt> - whether this cookie is accessible via scripting or only HTTP (defaults to false). 28 27 29 module Cookies 28 30 protected 29 31 # Returns the cookie container, which operates as described above.
