mcndave/storage
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

- WIP on making cookies and session more secures

Browse Source
This commit is contained in:
Dave Mc Nicoll 2026-10-19 19:47:24 +00:00
parent 3bc53f02e5
commit ad82e7f4fd
2 changed files with 23 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
src/Cookie.php
View File

@ -4,19 +4,21 @@ namespace Storage;
class Cookie {
public array $options = [
'expires' => (60*60*8), # Default to 8 hours now
const array DEFAULT_OPTIONS_CONFIG = [
'expires' => (60*60*7),
'path' => null,
'domain' => null,
'secure' => false,
'httponly' => true,
'samesite' => "Strict",
'samesite' => "Lax",
];
public array $options = [];
protected ? string $secureHash;
public function __construct(array $options, ? string $secureHash) {
$this->options = $options;
$this->options = array_replace(static::DEFAULT_OPTIONS_CONFIG, $options);
$this->secureHash = $secureHash;
}
@ -34,7 +36,7 @@ class Cookie {
public function set(
?string $key,
?string $value = null,
?int $expires = null,
null|int|false $expires = null,
?string $path = null,
?string $domain = null,
?bool $secure = null,
@ -49,21 +51,26 @@ class Cookie {
$key = $this->normalizeKey($key);
$expires = ! $expires ? 0 : (time() + $expires);
if ($expires === false || $expires === 0) {
$expires = 0;
}
else {
$expires = time() + ( is_null($expires) ? $this->options['expires'] : $expires );
}
$_COOKIE[$key] = $value;
$options = [
'expires' => $this->options['expires'] ?? ( $expires ?: 0 ),
'path' => $this->options['path'] ?? ( $path ?: "" ),
'domain' => $this->options['domain'] ?? ( $domain ?: "" ),
'secure' => $this->options['secure'] ?? ( $secure ?: false ),
'httponly' => $this->options['httponly'] ?? ( $httponly ?: false ),
'samesite' => $this->options['samesite'] ?? ( $samesite ?: "" ),
'expires' => $expires,
'path' => $path ?? $this->options['path'] ?? "",
'domain' => $domain ?? $this->options['domain'] ?? false ,
'secure' => $secure ?? $this->options['secure'] ?? false,
'httponly' => $httponly ?? $this->options['httponly'] ?? false,
'samesite' => $samesite ?? $this->options['samesite'] ?? "",
];
if ( $value && ! $skipHash ) {
$value = sha1($this->secureHash . $value . $this->secureHash) . "|$value";
$value = sha1($this->secureHash . $value . strrev($this->secureHash)) . "|$value";
}
return $raw ? setrawcookie($key, $value ?: "", $options) : setcookie($key, $value ?: "", $options);
@ -130,7 +137,7 @@ class Cookie {
public function isSecure($hash, $value) : bool
{
return sha1($this->secureHash . $value . $this->secureHash) === $hash;
return sha1($this->secureHash . $value . strrev($this->secureHash)) === $hash;
}
public function __invoke(...$arguments)

9
src/SessionMiddleware.php
View File

@ -12,12 +12,7 @@ class SessionMiddleware implements MiddlewareInterface
{
protected array $options = [
'name' => '',
'path' => null,
'domain' => null,
'secure' => false,
'httponly' => true,
'lifetime' => 43200, # A half-day
'samesite' => "",
'lifetime' => 12 * 60 * 60
];
protected Cookie $cookie;
@ -33,7 +28,7 @@ class SessionMiddleware implements MiddlewareInterface
$options['name'] = md5(__FILE__);
}
$this->options = array_merge($this->options, array_filter(array_intersect_key($this->cookie->options, array_flip(['path', 'domain', 'samesite']))), $options);
$this->options = array_replace($this->options, $this->cookie->options, $options);
$this->savePath = $savePath ?? sys_get_temp_dir();
}