diff options
| -rw-r--r-- | README.md | 3 | ||||
| -rw-r--r-- | lib/resty/cookie.lua | 13 | ||||
| -rw-r--r-- | t/sanity.t | 47 |
3 files changed, 57 insertions, 6 deletions
@@ -62,7 +62,7 @@ Synopsis key = "Name", value = "Bob", path = "/", domain = "example.com", secure = true, httponly = true, expires = "Wed, 09 Jun 2021 10:18:14 GMT", max_age = 50, - extension = "a4334aebaec" + samesite = "Strict", extension = "a4334aebaec" }) if not ok then ngx.log(ngx.ERR, err) @@ -122,6 +122,7 @@ syntax: ok, err = cookie_obj:set({ secure = true, httponly = true, expires = "Wed, 09 Jun 2021 10:18:14 GMT", max_age = 50, + samesite = "Strict", extension = "a4334aebaec" }) ``` diff --git a/lib/resty/cookie.lua b/lib/resty/cookie.lua index 11d435f..b61877e 100644 --- a/lib/resty/cookie.lua +++ b/lib/resty/cookie.lua @@ -8,6 +8,7 @@ local sub = string.sub local format = string.format local log = ngx.log local ERR = ngx.ERR +local WARN = ngx.WARN local ngx_header = ngx.header local EQUAL = byte("=") @@ -136,6 +137,17 @@ local function bake(cookie) if cookie["max-age"] then cookie.max_age = cookie["max-age"] end + + if (cookie.samesite) then + local samesite = cookie.samesite + + -- if we dont have a valid-looking attribute, ignore the attribute + if (samesite ~= "Strict" and samesite ~= "Lax") then + log(WARN, "SameSite value must be 'Strict' or 'Lax'") + cookie.samesite = nil + end + end + local str = cookie.key .. "=" .. cookie.value .. (cookie.expires and "; Expires=" .. cookie.expires or "") .. (cookie.max_age and "; Max-Age=" .. cookie.max_age or "") @@ -143,6 +155,7 @@ local function bake(cookie) .. (cookie.path and "; Path=" .. cookie.path or "") .. (cookie.secure and "; Secure" or "") .. (cookie.httponly and "; HttpOnly" or "") + .. (cookie.samesite and "; SameSite=" .. cookie.samesite or "") .. (cookie.extension and "; " .. cookie.extension or "") return str end @@ -5,7 +5,7 @@ use Cwd qw(cwd); repeat_each(2); -plan tests => repeat_each() * (blocks() * 3 + 4); +plan tests => repeat_each() * (blocks() * 3 + 6); my $pwd = cwd(); @@ -53,8 +53,6 @@ Cookie: SID=31d4d96e407aad42; lang=en-US SID => 31d4d96e407aad42 lang => en-US - - === TEST 2: sanity 2 --- http_config eval: $::HttpConfig --- config @@ -188,7 +186,7 @@ SID => foo key = "Name", value = "Bob", path = "/", domain = "example.com", secure = true, httponly = true, expires = "Wed, 09 Jun 2021 10:18:14 GMT", max_age = 50, - extension = "a4334aebaec" + samesite = "Strict", extension = "a4334aebaec" }) if not ok then ngx.log(ngx.ERR, err) @@ -202,7 +200,7 @@ GET /t --- no_error_log [error] --- response_headers -Set-Cookie: Name=Bob; Expires=Wed, 09 Jun 2021 10:18:14 GMT; Max-Age=50; Domain=example.com; Path=/; Secure; HttpOnly; a4334aebaec +Set-Cookie: Name=Bob; Expires=Wed, 09 Jun 2021 10:18:14 GMT; Max-Age=50; Domain=example.com; Path=/; Secure; HttpOnly; SameSite=Strict; a4334aebaec --- response_body Set cookie @@ -307,3 +305,42 @@ GET /t --- raw_response_headers_unlike: Set-Cookie: Name=Bob; Path=/\r\nSet-Cookie: Age=20\r\nSet-Cookie: Name=Bob; Path=/ --- response_body Set cookie + + +=== TEST 9: set cookie with invalid SameSite attribute +--- http_config eval: $::HttpConfig +--- config + location /t { + content_by_lua ' + local ck = require "resty.cookie" + local cookie, err = ck:new() + if not cookie then + ngx.log(ngx.ERR, err) + return + end + + local ok, err = cookie:set({ + key = "Name", value = "Bob", path = "/", + domain = "example.com", secure = true, httponly = true, + expires = "Wed, 09 Jun 2021 10:18:14 GMT", max_age = 50, + samesite = "blahblah", extension = "a4334aebaec" + }) + if not ok then + ngx.log(ngx.ERR, err) + return + end + ngx.say("Set cookie") + '; + } +--- request +GET /t +--- no_error_log +[error] +--- error_log +SameSite value must be 'Strict' or 'Lax' +--- response_headers +Set-Cookie: Name=Bob; Expires=Wed, 09 Jun 2021 10:18:14 GMT; Max-Age=50; Domain=example.com; Path=/; Secure; HttpOnly; a4334aebaec +--- response_body +Set cookie + + |