- WIP on making cookies and session more secures

composer.json

@@ -6,7 +6,7 @@
     "authors": [
         {
             "name": "Dave Mc Nicoll",
-            "email": "dave.mcnicoll@cslsj.qc.ca"
+            "email": "info@mcnd.ca"
         }
     ],
     "autoload": {

src/Cookie.php

@@ -4,19 +4,21 @@ namespace Storage;
 
 class Cookie {
 
-    public array $options = [
-        'expires'  => 0,
+    const array DEFAULT_OPTIONS_CONFIG = [
+        'expires'  => (60*60*7),
         'path'     => null,
         'domain'   => null,
         'secure'   => false,
         'httponly' => true,
-        'samesite' => "Strict",
+        'samesite' => "Lax",
     ];
 
+    public array $options = [];
+
     protected ? string $secureHash;
 
     public function __construct(array $options, ? string $secureHash) {
-        $this->options = $options;
+        $this->options = array_replace(static::DEFAULT_OPTIONS_CONFIG, $options);
         $this->secureHash = $secureHash;
     }
 
@@ -32,9 +34,9 @@ class Cookie {
      * @return  boolean
      */
     public function set(
-        ?string $name,
+        ?string $key,
         ?string $value = null,
-        ?int $expires = null,
+        null|int|false $expires = null,
         ?string $path = null,
         ?string $domain = null,
         ?bool $secure = null,
@@ -47,24 +49,31 @@ class Cookie {
             return false;
         }
 
-        $expires = ! $expires ? 0 : time() + (int) $expires;
+        $key = $this->normalizeKey($key);
 
-        $_COOKIE[$name] = $value;
+        if ($expires === false || $expires === 0) {
+            $expires = 0;
+        }
+        else {
+            $expires = time() + ( is_null($expires) ? $this->options['expires'] : $expires );
+        }
+
+        $_COOKIE[$key] = $value;
 
         $options = [
-            'expires'  => $this->options['expires']  ?? ( $expires ?: 0 ),
-            'path'     => $this->options['path']     ?? ( $path ?: "" ),
-            'domain'   => $this->options['domain']   ?? ( $domain ?: "" ),
-            'secure'   => $this->options['secure']   ?? ( $secure ?: false ),
-            'httponly' => $this->options['httponly'] ?? ( $httponly ?: false ),
-            'samesite' => $this->options['samesite'] ?? ( $samesite ?: "" ),
+            'expires'  => $expires,
+            'path'     => $path ?? $this->options['path'] ?? "",
+            'domain'   => $domain ?? $this->options['domain'] ?? false ,
+            'secure'   => $secure ?? $this->options['secure'] ?? false,
+            'httponly' => $httponly ?? $this->options['httponly'] ?? false,
+            'samesite' => $samesite ?? $this->options['samesite'] ?? "",
         ];
 
         if ( $value && ! $skipHash ) {
-            $value = sha1($this->secureHash . $value . $this->secureHash) . "|$value";
+            $value = sha1($this->secureHash . $value . strrev($this->secureHash)) . "|$value";
         }
 
-        return $raw ? setrawcookie($name, $value ?: "", $options) : setcookie($name, $value ?: "", $options);
+        return $raw ? setrawcookie($key, $value ?: "", $options) : setcookie($key, $value ?: "", $options);
     }
 
     /**
@@ -89,6 +98,8 @@ class Cookie {
             list($hash, $value) = explode('|', $_COOKIE[$key], 2);
 
             if (! $this->isSecure($hash, $value)) {
+                $this->delete($key);
+
                 throw new Exception\CookieInvalidSecureHashException("Invalid cookie hash value given.");
             }
 
@@ -126,7 +137,7 @@ class Cookie {
 
     public function isSecure($hash, $value) : bool
     {
-        return sha1($this->secureHash . $value . $this->secureHash) === $hash;
+        return sha1($this->secureHash . $value . strrev($this->secureHash)) === $hash;
     }
 
     public function __invoke(...$arguments)
@@ -159,6 +170,6 @@ class Cookie {
 
     protected function normalizeKey(string $key) : string
     {
-        return str_replace(['.', ' ',], '_', $key);
+        return str_replace([',', ';', ' ', '=', '.'], '_', $key);
     }
 }

src/Session.php

@@ -8,17 +8,22 @@ use session_name, session_id, session_start, session_destroy, session_save_path,
 
 class Session
 {
-    public static function get($key, $default = null)
+    public static function get($key, $default = null) : mixed
     {
         return static::has($key) ? $_SESSION[$key] : $default;
     }
 
-    public static function set($key, $value)
+    public static function define($key, $value) : bool
+    {
+        return static::has($key) ? false : static::set($key, $value) || true;
+    }
+
+    public static function set($key, $value) : mixed
     {
         return $_SESSION[$key] = $value;
     }
 
-    public static function delete($key)
+    public static function delete($key) : void
     {
         unset($_SESSION[$key]);
     }

src/SessionMiddleware.php

@@ -12,12 +12,7 @@ class SessionMiddleware implements MiddlewareInterface
 {
     protected array $options = [
         'name' => '',
-        'path' => null,
-        'domain' => null,
-        'secure' => false,
-        'httponly' => true,
-        'lifetime' => 43200,  # A half-day
-        'samesite' => "",
+        'lifetime' => 12 * 60 * 60
     ];
 
     protected Cookie $cookie;
@@ -33,7 +28,7 @@ class SessionMiddleware implements MiddlewareInterface
             $options['name'] = md5(__FILE__);
         }
 
-        $this->options = array_merge($this->options, array_filter(array_intersect_key($this->cookie->options, array_flip(['path', 'domain', 'samesite']))), $options);
+        $this->options = array_replace($this->options,  $this->cookie->options, $options);
 
         $this->savePath = $savePath ?? sys_get_temp_dir();
     }