Cookie.php 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524
  1. <?php
  2. namespace Http\Message;
  3. /**
  4. * Cookie Value Object.
  5. *
  6. * @author Márk Sági-Kazár <mark.sagikazar@gmail.com>
  7. *
  8. * @see http://tools.ietf.org/search/rfc6265
  9. */
  10. final class Cookie
  11. {
  12. /**
  13. * @var string
  14. */
  15. private $name;
  16. /**
  17. * @var string|null
  18. */
  19. private $value;
  20. /**
  21. * @var int|null
  22. */
  23. private $maxAge;
  24. /**
  25. * @var string|null
  26. */
  27. private $domain;
  28. /**
  29. * @var string
  30. */
  31. private $path;
  32. /**
  33. * @var bool
  34. */
  35. private $secure;
  36. /**
  37. * @var bool
  38. */
  39. private $httpOnly;
  40. /**
  41. * Expires attribute is HTTP 1.0 only and should be avoided.
  42. *
  43. * @var \DateTime|null
  44. */
  45. private $expires;
  46. /**
  47. * @param string $name
  48. * @param string|null $value
  49. * @param int|null $maxAge
  50. * @param string|null $domain
  51. * @param string|null $path
  52. * @param bool $secure
  53. * @param bool $httpOnly
  54. * @param \DateTime|null $expires Expires attribute is HTTP 1.0 only and should be avoided.
  55. *
  56. * @throws \InvalidArgumentException if name, value or max age is not valid
  57. */
  58. public function __construct(
  59. $name,
  60. $value = null,
  61. $maxAge = null,
  62. $domain = null,
  63. $path = null,
  64. $secure = false,
  65. $httpOnly = false,
  66. \DateTime $expires = null
  67. ) {
  68. $this->validateName($name);
  69. $this->validateValue($value);
  70. $this->validateMaxAge($maxAge);
  71. $this->name = $name;
  72. $this->value = $value;
  73. $this->maxAge = $maxAge;
  74. $this->expires = $expires;
  75. $this->domain = $this->normalizeDomain($domain);
  76. $this->path = $this->normalizePath($path);
  77. $this->secure = (bool) $secure;
  78. $this->httpOnly = (bool) $httpOnly;
  79. }
  80. /**
  81. * Creates a new cookie without any attribute validation.
  82. *
  83. * @param string $name
  84. * @param string|null $value
  85. * @param int $maxAge
  86. * @param string|null $domain
  87. * @param string|null $path
  88. * @param bool $secure
  89. * @param bool $httpOnly
  90. * @param \DateTime|null $expires Expires attribute is HTTP 1.0 only and should be avoided.
  91. */
  92. public static function createWithoutValidation(
  93. $name,
  94. $value = null,
  95. $maxAge = null,
  96. $domain = null,
  97. $path = null,
  98. $secure = false,
  99. $httpOnly = false,
  100. \DateTime $expires = null
  101. ) {
  102. $cookie = new self('name', null, null, $domain, $path, $secure, $httpOnly, $expires);
  103. $cookie->name = $name;
  104. $cookie->value = $value;
  105. $cookie->maxAge = $maxAge;
  106. return $cookie;
  107. }
  108. /**
  109. * Returns the name.
  110. *
  111. * @return string
  112. */
  113. public function getName()
  114. {
  115. return $this->name;
  116. }
  117. /**
  118. * Returns the value.
  119. *
  120. * @return string|null
  121. */
  122. public function getValue()
  123. {
  124. return $this->value;
  125. }
  126. /**
  127. * Checks if there is a value.
  128. *
  129. * @return bool
  130. */
  131. public function hasValue()
  132. {
  133. return isset($this->value);
  134. }
  135. /**
  136. * Sets the value.
  137. *
  138. * @param string|null $value
  139. *
  140. * @return Cookie
  141. */
  142. public function withValue($value)
  143. {
  144. $this->validateValue($value);
  145. $new = clone $this;
  146. $new->value = $value;
  147. return $new;
  148. }
  149. /**
  150. * Returns the max age.
  151. *
  152. * @return int|null
  153. */
  154. public function getMaxAge()
  155. {
  156. return $this->maxAge;
  157. }
  158. /**
  159. * Checks if there is a max age.
  160. *
  161. * @return bool
  162. */
  163. public function hasMaxAge()
  164. {
  165. return isset($this->maxAge);
  166. }
  167. /**
  168. * Sets the max age.
  169. *
  170. * @param int|null $maxAge
  171. *
  172. * @return Cookie
  173. */
  174. public function withMaxAge($maxAge)
  175. {
  176. $this->validateMaxAge($maxAge);
  177. $new = clone $this;
  178. $new->maxAge = $maxAge;
  179. return $new;
  180. }
  181. /**
  182. * Returns the expiration time.
  183. *
  184. * @return \DateTime|null
  185. */
  186. public function getExpires()
  187. {
  188. return $this->expires;
  189. }
  190. /**
  191. * Checks if there is an expiration time.
  192. *
  193. * @return bool
  194. */
  195. public function hasExpires()
  196. {
  197. return isset($this->expires);
  198. }
  199. /**
  200. * Sets the expires.
  201. *
  202. * @return Cookie
  203. */
  204. public function withExpires(\DateTime $expires = null)
  205. {
  206. $new = clone $this;
  207. $new->expires = $expires;
  208. return $new;
  209. }
  210. /**
  211. * Checks if the cookie is expired.
  212. *
  213. * @return bool
  214. */
  215. public function isExpired()
  216. {
  217. return isset($this->expires) and $this->expires < new \DateTime();
  218. }
  219. /**
  220. * Returns the domain.
  221. *
  222. * @return string|null
  223. */
  224. public function getDomain()
  225. {
  226. return $this->domain;
  227. }
  228. /**
  229. * Checks if there is a domain.
  230. *
  231. * @return bool
  232. */
  233. public function hasDomain()
  234. {
  235. return isset($this->domain);
  236. }
  237. /**
  238. * Sets the domain.
  239. *
  240. * @param string|null $domain
  241. *
  242. * @return Cookie
  243. */
  244. public function withDomain($domain)
  245. {
  246. $new = clone $this;
  247. $new->domain = $this->normalizeDomain($domain);
  248. return $new;
  249. }
  250. /**
  251. * Checks whether this cookie is meant for this domain.
  252. *
  253. * @see http://tools.ietf.org/html/rfc6265#section-5.1.3
  254. *
  255. * @param string $domain
  256. *
  257. * @return bool
  258. */
  259. public function matchDomain($domain)
  260. {
  261. // Domain is not set or exact match
  262. if (!$this->hasDomain() || 0 === strcasecmp($domain, $this->domain)) {
  263. return true;
  264. }
  265. // Domain is not an IP address
  266. if (filter_var($domain, FILTER_VALIDATE_IP)) {
  267. return false;
  268. }
  269. return (bool) preg_match(sprintf('/\b%s$/i', preg_quote($this->domain)), $domain);
  270. }
  271. /**
  272. * Returns the path.
  273. *
  274. * @return string
  275. */
  276. public function getPath()
  277. {
  278. return $this->path;
  279. }
  280. /**
  281. * Sets the path.
  282. *
  283. * @param string|null $path
  284. *
  285. * @return Cookie
  286. */
  287. public function withPath($path)
  288. {
  289. $new = clone $this;
  290. $new->path = $this->normalizePath($path);
  291. return $new;
  292. }
  293. /**
  294. * Checks whether this cookie is meant for this path.
  295. *
  296. * @see http://tools.ietf.org/html/rfc6265#section-5.1.4
  297. *
  298. * @param string $path
  299. *
  300. * @return bool
  301. */
  302. public function matchPath($path)
  303. {
  304. return $this->path === $path || (0 === strpos($path, rtrim($this->path, '/').'/'));
  305. }
  306. /**
  307. * Checks whether this cookie may only be sent over HTTPS.
  308. *
  309. * @return bool
  310. */
  311. public function isSecure()
  312. {
  313. return $this->secure;
  314. }
  315. /**
  316. * Sets whether this cookie should only be sent over HTTPS.
  317. *
  318. * @param bool $secure
  319. *
  320. * @return Cookie
  321. */
  322. public function withSecure($secure)
  323. {
  324. $new = clone $this;
  325. $new->secure = (bool) $secure;
  326. return $new;
  327. }
  328. /**
  329. * Check whether this cookie may not be accessed through Javascript.
  330. *
  331. * @return bool
  332. */
  333. public function isHttpOnly()
  334. {
  335. return $this->httpOnly;
  336. }
  337. /**
  338. * Sets whether this cookie may not be accessed through Javascript.
  339. *
  340. * @param bool $httpOnly
  341. *
  342. * @return Cookie
  343. */
  344. public function withHttpOnly($httpOnly)
  345. {
  346. $new = clone $this;
  347. $new->httpOnly = (bool) $httpOnly;
  348. return $new;
  349. }
  350. /**
  351. * Checks if this cookie represents the same cookie as $cookie.
  352. *
  353. * This does not compare the values, only name, domain and path.
  354. *
  355. * @param Cookie $cookie
  356. *
  357. * @return bool
  358. */
  359. public function match(self $cookie)
  360. {
  361. return $this->name === $cookie->name && $this->domain === $cookie->domain and $this->path === $cookie->path;
  362. }
  363. /**
  364. * Validates cookie attributes.
  365. *
  366. * @return bool
  367. */
  368. public function isValid()
  369. {
  370. try {
  371. $this->validateName($this->name);
  372. $this->validateValue($this->value);
  373. $this->validateMaxAge($this->maxAge);
  374. } catch (\InvalidArgumentException $e) {
  375. return false;
  376. }
  377. return true;
  378. }
  379. /**
  380. * Validates the name attribute.
  381. *
  382. * @see http://tools.ietf.org/search/rfc2616#section-2.2
  383. *
  384. * @param string $name
  385. *
  386. * @throws \InvalidArgumentException if the name is empty or contains invalid characters
  387. */
  388. private function validateName($name)
  389. {
  390. if (strlen($name) < 1) {
  391. throw new \InvalidArgumentException('The name cannot be empty');
  392. }
  393. // Name attribute is a token as per spec in RFC 2616
  394. if (preg_match('/[\x00-\x20\x22\x28-\x29\x2C\x2F\x3A-\x40\x5B-\x5D\x7B\x7D\x7F]/', $name)) {
  395. throw new \InvalidArgumentException(sprintf('The cookie name "%s" contains invalid characters.', $name));
  396. }
  397. }
  398. /**
  399. * Validates a value.
  400. *
  401. * @see http://tools.ietf.org/html/rfc6265#section-4.1.1
  402. *
  403. * @param string|null $value
  404. *
  405. * @throws \InvalidArgumentException if the value contains invalid characters
  406. */
  407. private function validateValue($value)
  408. {
  409. if (isset($value)) {
  410. if (preg_match('/[^\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]/', $value)) {
  411. throw new \InvalidArgumentException(sprintf('The cookie value "%s" contains invalid characters.', $value));
  412. }
  413. }
  414. }
  415. /**
  416. * Validates a Max-Age attribute.
  417. *
  418. * @param int|null $maxAge
  419. *
  420. * @throws \InvalidArgumentException if the Max-Age is not an empty or integer value
  421. */
  422. private function validateMaxAge($maxAge)
  423. {
  424. if (isset($maxAge)) {
  425. if (!is_int($maxAge)) {
  426. throw new \InvalidArgumentException('Max-Age must be integer');
  427. }
  428. }
  429. }
  430. /**
  431. * Remove the leading '.' and lowercase the domain as per spec in RFC 6265.
  432. *
  433. * @see http://tools.ietf.org/html/rfc6265#section-4.1.2.3
  434. * @see http://tools.ietf.org/html/rfc6265#section-5.1.3
  435. * @see http://tools.ietf.org/html/rfc6265#section-5.2.3
  436. *
  437. * @param string|null $domain
  438. *
  439. * @return string
  440. */
  441. private function normalizeDomain($domain)
  442. {
  443. if (isset($domain)) {
  444. $domain = ltrim(strtolower($domain), '.');
  445. }
  446. return $domain;
  447. }
  448. /**
  449. * Processes path as per spec in RFC 6265.
  450. *
  451. * @see http://tools.ietf.org/html/rfc6265#section-5.1.4
  452. * @see http://tools.ietf.org/html/rfc6265#section-5.2.4
  453. *
  454. * @param string|null $path
  455. *
  456. * @return string
  457. */
  458. private function normalizePath($path)
  459. {
  460. $path = rtrim($path, '/');
  461. if (empty($path) or '/' !== substr($path, 0, 1)) {
  462. $path = '/';
  463. }
  464. return $path;
  465. }
  466. }