Cookie.php 7.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292
  1. <?php
  2. /*
  3. * This file is part of the Symfony package.
  4. *
  5. * (c) Fabien Potencier <fabien@symfony.com>
  6. *
  7. * For the full copyright and license information, please view the LICENSE
  8. * file that was distributed with this source code.
  9. */
  10. namespace Symfony\Component\HttpFoundation;
  11. /**
  12. * Represents a cookie.
  13. *
  14. * @author Johannes M. Schmitt <schmittjoh@gmail.com>
  15. */
  16. class Cookie
  17. {
  18. protected $name;
  19. protected $value;
  20. protected $domain;
  21. protected $expire;
  22. protected $path;
  23. protected $secure;
  24. protected $httpOnly;
  25. private $raw;
  26. private $sameSite;
  27. const SAMESITE_NONE = 'none';
  28. const SAMESITE_LAX = 'lax';
  29. const SAMESITE_STRICT = 'strict';
  30. /**
  31. * Creates cookie from raw header string.
  32. *
  33. * @param string $cookie
  34. * @param bool $decode
  35. *
  36. * @return static
  37. */
  38. public static function fromString($cookie, $decode = false)
  39. {
  40. $data = [
  41. 'expires' => 0,
  42. 'path' => '/',
  43. 'domain' => null,
  44. 'secure' => false,
  45. 'httponly' => false,
  46. 'raw' => !$decode,
  47. 'samesite' => null,
  48. ];
  49. foreach (explode(';', $cookie) as $part) {
  50. if (false === strpos($part, '=')) {
  51. $key = trim($part);
  52. $value = true;
  53. } else {
  54. list($key, $value) = explode('=', trim($part), 2);
  55. $key = trim($key);
  56. $value = trim($value);
  57. }
  58. if (!isset($data['name'])) {
  59. $data['name'] = $decode ? urldecode($key) : $key;
  60. $data['value'] = true === $value ? null : ($decode ? urldecode($value) : $value);
  61. continue;
  62. }
  63. switch ($key = strtolower($key)) {
  64. case 'name':
  65. case 'value':
  66. break;
  67. case 'max-age':
  68. $data['expires'] = time() + (int) $value;
  69. break;
  70. default:
  71. $data[$key] = $value;
  72. break;
  73. }
  74. }
  75. return new static($data['name'], $data['value'], $data['expires'], $data['path'], $data['domain'], $data['secure'], $data['httponly'], $data['raw'], $data['samesite']);
  76. }
  77. /**
  78. * @param string $name The name of the cookie
  79. * @param string|null $value The value of the cookie
  80. * @param int|string|\DateTimeInterface $expire The time the cookie expires
  81. * @param string $path The path on the server in which the cookie will be available on
  82. * @param string|null $domain The domain that the cookie is available to
  83. * @param bool $secure Whether the cookie should only be transmitted over a secure HTTPS connection from the client
  84. * @param bool $httpOnly Whether the cookie will be made accessible only through the HTTP protocol
  85. * @param bool $raw Whether the cookie value should be sent with no url encoding
  86. * @param string|null $sameSite Whether the cookie will be available for cross-site requests
  87. *
  88. * @throws \InvalidArgumentException
  89. */
  90. public function __construct($name, $value = null, $expire = 0, $path = '/', $domain = null, $secure = false, $httpOnly = true, $raw = false, $sameSite = null)
  91. {
  92. // from PHP source code
  93. if (preg_match("/[=,; \t\r\n\013\014]/", $name)) {
  94. throw new \InvalidArgumentException(sprintf('The cookie name "%s" contains invalid characters.', $name));
  95. }
  96. if (empty($name)) {
  97. throw new \InvalidArgumentException('The cookie name cannot be empty.');
  98. }
  99. // convert expiration time to a Unix timestamp
  100. if ($expire instanceof \DateTimeInterface) {
  101. $expire = $expire->format('U');
  102. } elseif (!is_numeric($expire)) {
  103. $expire = strtotime($expire);
  104. if (false === $expire) {
  105. throw new \InvalidArgumentException('The cookie expiration time is not valid.');
  106. }
  107. }
  108. $this->name = $name;
  109. $this->value = $value;
  110. $this->domain = $domain;
  111. $this->expire = 0 < $expire ? (int) $expire : 0;
  112. $this->path = empty($path) ? '/' : $path;
  113. $this->secure = (bool) $secure;
  114. $this->httpOnly = (bool) $httpOnly;
  115. $this->raw = (bool) $raw;
  116. if (null !== $sameSite) {
  117. $sameSite = strtolower($sameSite);
  118. }
  119. if (!\in_array($sameSite, [self::SAMESITE_LAX, self::SAMESITE_STRICT, self::SAMESITE_NONE, null], true)) {
  120. throw new \InvalidArgumentException('The "sameSite" parameter value is not valid.');
  121. }
  122. $this->sameSite = $sameSite;
  123. }
  124. /**
  125. * Returns the cookie as a string.
  126. *
  127. * @return string The cookie
  128. */
  129. public function __toString()
  130. {
  131. $str = ($this->isRaw() ? $this->getName() : urlencode($this->getName())).'=';
  132. if ('' === (string) $this->getValue()) {
  133. $str .= 'deleted; expires='.gmdate('D, d-M-Y H:i:s T', time() - 31536001).'; Max-Age=0';
  134. } else {
  135. $str .= $this->isRaw() ? $this->getValue() : rawurlencode($this->getValue());
  136. if (0 !== $this->getExpiresTime()) {
  137. $str .= '; expires='.gmdate('D, d-M-Y H:i:s T', $this->getExpiresTime()).'; Max-Age='.$this->getMaxAge();
  138. }
  139. }
  140. if ($this->getPath()) {
  141. $str .= '; path='.$this->getPath();
  142. }
  143. if ($this->getDomain()) {
  144. $str .= '; domain='.$this->getDomain();
  145. }
  146. if (true === $this->isSecure()) {
  147. $str .= '; secure';
  148. }
  149. if (true === $this->isHttpOnly()) {
  150. $str .= '; httponly';
  151. }
  152. if (null !== $this->getSameSite()) {
  153. $str .= '; samesite='.$this->getSameSite();
  154. }
  155. return $str;
  156. }
  157. /**
  158. * Gets the name of the cookie.
  159. *
  160. * @return string
  161. */
  162. public function getName()
  163. {
  164. return $this->name;
  165. }
  166. /**
  167. * Gets the value of the cookie.
  168. *
  169. * @return string|null
  170. */
  171. public function getValue()
  172. {
  173. return $this->value;
  174. }
  175. /**
  176. * Gets the domain that the cookie is available to.
  177. *
  178. * @return string|null
  179. */
  180. public function getDomain()
  181. {
  182. return $this->domain;
  183. }
  184. /**
  185. * Gets the time the cookie expires.
  186. *
  187. * @return int
  188. */
  189. public function getExpiresTime()
  190. {
  191. return $this->expire;
  192. }
  193. /**
  194. * Gets the max-age attribute.
  195. *
  196. * @return int
  197. */
  198. public function getMaxAge()
  199. {
  200. $maxAge = $this->expire - time();
  201. return 0 >= $maxAge ? 0 : $maxAge;
  202. }
  203. /**
  204. * Gets the path on the server in which the cookie will be available on.
  205. *
  206. * @return string
  207. */
  208. public function getPath()
  209. {
  210. return $this->path;
  211. }
  212. /**
  213. * Checks whether the cookie should only be transmitted over a secure HTTPS connection from the client.
  214. *
  215. * @return bool
  216. */
  217. public function isSecure()
  218. {
  219. return $this->secure;
  220. }
  221. /**
  222. * Checks whether the cookie will be made accessible only through the HTTP protocol.
  223. *
  224. * @return bool
  225. */
  226. public function isHttpOnly()
  227. {
  228. return $this->httpOnly;
  229. }
  230. /**
  231. * Whether this cookie is about to be cleared.
  232. *
  233. * @return bool
  234. */
  235. public function isCleared()
  236. {
  237. return 0 !== $this->expire && $this->expire < time();
  238. }
  239. /**
  240. * Checks if the cookie value should be sent with no url encoding.
  241. *
  242. * @return bool
  243. */
  244. public function isRaw()
  245. {
  246. return $this->raw;
  247. }
  248. /**
  249. * Gets the SameSite attribute.
  250. *
  251. * @return string|null
  252. */
  253. public function getSameSite()
  254. {
  255. return $this->sameSite;
  256. }
  257. }