diff --git a/src/Cookie.php b/src/Cookie.php index 183718f..cefdbcf 100644 --- a/src/Cookie.php +++ b/src/Cookie.php @@ -4,19 +4,21 @@ namespace Storage; class Cookie { - public array $options = [ - 'expires' => (60*60*8), # Default to 8 hours now + const array DEFAULT_OPTIONS_CONFIG = [ + 'expires' => (60*60*7), 'path' => null, 'domain' => null, 'secure' => false, 'httponly' => true, - 'samesite' => "Strict", + 'samesite' => "Lax", ]; + public array $options = []; + protected ? string $secureHash; public function __construct(array $options, ? string $secureHash) { - $this->options = $options; + $this->options = array_replace(static::DEFAULT_OPTIONS_CONFIG, $options); $this->secureHash = $secureHash; } @@ -34,7 +36,7 @@ class Cookie { public function set( ?string $key, ?string $value = null, - ?int $expires = null, + null|int|false $expires = null, ?string $path = null, ?string $domain = null, ?bool $secure = null, @@ -49,21 +51,26 @@ class Cookie { $key = $this->normalizeKey($key); - $expires = ! $expires ? 0 : (time() + $expires); + if ($expires === false || $expires === 0) { + $expires = 0; + } + else { + $expires = time() + ( is_null($expires) ? $this->options['expires'] : $expires ); + } $_COOKIE[$key] = $value; $options = [ - 'expires' => $this->options['expires'] ?? ( $expires ?: 0 ), - 'path' => $this->options['path'] ?? ( $path ?: "" ), - 'domain' => $this->options['domain'] ?? ( $domain ?: "" ), - 'secure' => $this->options['secure'] ?? ( $secure ?: false ), - 'httponly' => $this->options['httponly'] ?? ( $httponly ?: false ), - 'samesite' => $this->options['samesite'] ?? ( $samesite ?: "" ), + 'expires' => $expires, + 'path' => $path ?? $this->options['path'] ?? "", + 'domain' => $domain ?? $this->options['domain'] ?? false , + 'secure' => $secure ?? $this->options['secure'] ?? false, + 'httponly' => $httponly ?? $this->options['httponly'] ?? false, + 'samesite' => $samesite ?? $this->options['samesite'] ?? "", ]; if ( $value && ! $skipHash ) { - $value = sha1($this->secureHash . $value . $this->secureHash) . "|$value"; + $value = sha1($this->secureHash . $value . strrev($this->secureHash)) . "|$value"; } return $raw ? setrawcookie($key, $value ?: "", $options) : setcookie($key, $value ?: "", $options); @@ -130,7 +137,7 @@ class Cookie { public function isSecure($hash, $value) : bool { - return sha1($this->secureHash . $value . $this->secureHash) === $hash; + return sha1($this->secureHash . $value . strrev($this->secureHash)) === $hash; } public function __invoke(...$arguments) diff --git a/src/SessionMiddleware.php b/src/SessionMiddleware.php index 8585569..f2d14de 100644 --- a/src/SessionMiddleware.php +++ b/src/SessionMiddleware.php @@ -12,12 +12,7 @@ class SessionMiddleware implements MiddlewareInterface { protected array $options = [ 'name' => '', - 'path' => null, - 'domain' => null, - 'secure' => false, - 'httponly' => true, - 'lifetime' => 43200, # A half-day - 'samesite' => "", + 'lifetime' => 12 * 60 * 60 ]; protected Cookie $cookie; @@ -33,7 +28,7 @@ class SessionMiddleware implements MiddlewareInterface $options['name'] = md5(__FILE__); } - $this->options = array_merge($this->options, array_filter(array_intersect_key($this->cookie->options, array_flip(['path', 'domain', 'samesite']))), $options); + $this->options = array_replace($this->options, $this->cookie->options, $options); $this->savePath = $savePath ?? sys_get_temp_dir(); }