Ticket #8895: http_only_cookies.patch
| File http_only_cookies.patch, 3.7 kB (added by Spakman, 1 year ago) |
|---|
-
test/controller/cookie_test.rb
old new 36 36 render_text "hello world" 37 37 end 38 38 39 def authenticate_with_http_only 40 cookies["user_name"] = { :value => "david", :http_only => true } 41 end 42 39 43 def rescue_action(e) 40 44 raise unless ActionController::MissingTemplate # No templates here, and we don't care about the output 41 45 end … … 69 73 assert_equal [ CGI::Cookie::new("name" => "user_name", "value" => "david", "expires" => Time.local(2005, 10, 10)) ], @response.headers["cookie"] 70 74 end 71 75 76 def test_setting_cookie_with_http_only 77 get :authenticate_with_http_only 78 assert_equal [ CGI::Cookie::new("name" => "user_name", "value" => "david", "http_only" => true) ], @response.headers["cookie"] 79 assert_equal CGI::Cookie::new("name" => "user_name", "value" => "david", "path" => "/", "http_only" => true).to_s, @response.headers["cookie"].to_s 80 end 81 72 82 def test_multiple_cookies 73 83 get :set_multiple_cookies 74 84 assert_equal 2, @response.cookies.size -
lib/action_controller/cgi_ext/cookie.rb
old new 19 19 # secure:: whether this cookie is a secure cookie or not (default to 20 20 # false). Secure cookies are only transmitted to HTTPS 21 21 # servers. 22 # http_only:: whether the session should only be accessible via HTTP, not scripting - see http://msdn2.microsoft.com/en-us/library/system.web.httpcookie.httponly.aspx 22 23 # 23 24 # These keywords correspond to attributes of the cookie object. 24 25 def initialize(name = '', *value) … … 28 29 @domain = nil 29 30 @expires = nil 30 31 @secure = false 32 @http_only = false 31 33 @path = nil 32 34 else 33 35 @name = name['name'] … … 35 37 @domain = name['domain'] 36 38 @expires = name['expires'] 37 39 @secure = name['secure'] || false 40 @http_only = name['http_only'] || false 38 41 @path = name['path'] 39 42 end 40 43 … … 56 59 end 57 60 58 61 attr_accessor("name", "value", "path", "domain", "expires") 59 attr_reader("secure" )62 attr_reader("secure", "http_only") 60 63 61 64 # Set whether the Cookie is a secure cookie or not. 62 65 # … … 66 69 @secure 67 70 end 68 71 72 # Set whether the Cookie is a HTTP only or not. 73 # 74 # +val+ must be a boolean. 75 def http_only=(val) 76 @http_only = val if val == true or val == false 77 @http_only 78 end 79 69 80 # Convert the Cookie to its string representation. 70 81 def to_s 71 82 buf = "" … … 93 104 buf << '; secure' 94 105 end 95 106 107 if @http_only == true 108 buf << '; HttpOnly' 109 end 110 96 111 buf 97 112 end 98 113 -
lib/action_controller/cookies.rb
old new 22 22 # * <tt>path</tt> - the path for which this cookie applies. Defaults to the root of the application. 23 23 # * <tt>domain</tt> - the domain for which this cookie applies. 24 24 # * <tt>expires</tt> - the time at which this cookie expires, as a +Time+ object. 25 # * <tt>http_only</tt> - whether this cookie is accessible via scripting or only HTTP (defaults to false). 25 26 # * <tt>secure</tt> - whether this cookie is a secure cookie or not (default to false). 26 27 # Secure cookies are only transmitted to HTTPS servers. 27 28 module Cookies
