src/cookie.bend
emerging-ezhttp@0.19.0.0 · 542 lines · 0 definitions
1# ezhttp/src/cookie: Set-Cookie and Cookie (RFC 6265 §§4–5). A thin jar: parse
2# attributes, serialize the request header, and domain/path/secure matching.
3# Expires is stored, not evaluated against a clock. SameSite is stored; there
4# is no browsing context to suppress cross-site sends.
5import Base
6import emerging-ezhttp@0.19.0.0/src/http.bend as Http
7
8# one cookie. host_only means the Domain attribute was absent (exact host).
9type Cookie is Data:
10 Cookie{
11 name: String
12 value: String
13 expires: String
14 max_age: String
15 domain: String
16 path: String
17 secure: Bool
18 http_only: Bool
19 same_site: String
20 host_only: Bool
21 }
22
23# a session cookie with no attributes yet
24def cookie.new(name: String, value: String) -> Cookie:
25 Cookie{name, value, "", "", "", "", False{}, False{}, "", True{}}
26
27# replace Expires
28def cookie.expires(c: Cookie, when: String) -> Cookie:
29 match c:
30 case Cookie{name, value, expires, max_age, domain, path, secure, http_only,
31 same_site, host_only}:
32 Cookie{name, value, when, max_age, domain, path, secure, http_only,
33 same_site, host_only}
34
35# replace Max-Age
36def cookie.age(c: Cookie, age: String) -> Cookie:
37 match c:
38 case Cookie{name, value, expires, max_age, domain, path, secure, http_only,
39 same_site, host_only}:
40 Cookie{name, value, expires, age, domain, path, secure, http_only,
41 same_site, host_only}
42
43# replace Domain and clear host-only
44def cookie.domain(c: Cookie, host: String) -> Cookie:
45 match c:
46 case Cookie{name, value, expires, max_age, domain, path, secure, http_only,
47 same_site, host_only}:
48 Cookie{name, value, expires, max_age, host, path, secure, http_only,
49 same_site, False{}}
50
51# replace Path
52def cookie.dir(c: Cookie, dir: String) -> Cookie:
53 match c:
54 case Cookie{name, value, expires, max_age, domain, path, secure, http_only,
55 same_site, host_only}:
56 Cookie{name, value, expires, max_age, domain, dir, secure, http_only,
57 same_site, host_only}
58
59# set the Secure flag
60def cookie.secure_on(c: Cookie) -> Cookie:
61 match c:
62 case Cookie{name, value, expires, max_age, domain, path, secure, http_only,
63 same_site, host_only}:
64 Cookie{name, value, expires, max_age, domain, path, True{}, http_only,
65 same_site, host_only}
66
67# set the HttpOnly flag
68def cookie.http_on(c: Cookie) -> Cookie:
69 match c:
70 case Cookie{name, value, expires, max_age, domain, path, secure, http_only,
71 same_site, host_only}:
72 Cookie{name, value, expires, max_age, domain, path, secure, True{},
73 same_site, host_only}
74
75# replace SameSite
76def cookie.site_set(c: Cookie, site: String) -> Cookie:
77 match c:
78 case Cookie{name, value, expires, max_age, domain, path, secure, http_only,
79 same_site, host_only}:
80 Cookie{name, value, expires, max_age, domain, path, secure, http_only,
81 site, host_only}
82
83# None, or unrecognized
84def cookie.site.none(_low: String, hit: Bool) -> String:
85 match hit:
86 case True{}:
87 "None"
88 case False{}:
89 ""
90
91# Strict, or continue
92def cookie.site.strict(+low: String, hit: Bool) -> String:
93 match hit:
94 case True{}:
95 "Strict"
96 case False{}:
97 cookie.site.none(low, String.eq(low, "none"))
98
99# Lax / Strict / None, canonical spelling (RFC 6265bis SameSite)
100def cookie.site.lax(+low: String, hit: Bool) -> String:
101 match hit:
102 case True{}:
103 "Lax"
104 case False{}:
105 cookie.site.strict(low, String.eq(low, "strict"))
106
107# canonicalize a SameSite value; anything else is dropped
108def cookie.site(+raw: String) -> String:
109 +low = String.to_lower(raw)
110 cookie.site.lax(low, String.eq(low, "lax"))
111
112# keep a numeric Max-Age, ignore the attribute when it is not digits
113def cookie.age_ok(c: Cookie, +raw: String, m: Maybe<&2, Nat>) -> Cookie:
114 match m:
115 case None{}:
116 c
117 case Some{n}:
118 cookie.age(c, raw)
119
120# HttpOnly flag, or leave the cookie alone
121def cookie.flag.http(c: Cookie, _name: String, hit: Bool) -> Cookie:
122 match hit:
123 case True{}:
124 cookie.http_on(c)
125 case False{}:
126 c
127
128# Secure flag, else HttpOnly
129def cookie.flag.secure(c: Cookie, +name: String, hit: Bool) -> Cookie:
130 match hit:
131 case True{}:
132 cookie.secure_on(c)
133 case False{}:
134 cookie.flag.http(c, name, String.eq(name, "httponly"))
135
136# a flag attribute (no equals sign)
137def cookie.flag(c: Cookie, +name: String) -> Cookie:
138 cookie.flag.secure(c, name, String.eq(name, "secure"))
139
140# SameSite, or an unrecognized attribute
141def cookie.named.site(c: Cookie, _name: String, value: String, hit: Bool)
142 -> Cookie:
143 match hit:
144 case True{}:
145 cookie.site_set(c, cookie.site(value))
146 case False{}:
147 c
148
149# Path
150def cookie.named.path(c: Cookie, +name: String, +value: String, hit: Bool)
151 -> Cookie:
152 match hit:
153 case True{}:
154 cookie.dir(c, value)
155 case False{}:
156 cookie.named.site(c, name, value, String.eq(name, "samesite"))
157
158# Domain, stored lowercase
159def cookie.named.domain(c: Cookie, +name: String, +value: String, hit: Bool)
160 -> Cookie:
161 match hit:
162 case True{}:
163 cookie.domain(c, String.to_lower(value))
164 case False{}:
165 cookie.named.path(c, name, value, String.eq(name, "path"))
166
167# Max-Age
168def cookie.named.age(c: Cookie, +name: String, +value: String, hit: Bool)
169 -> Cookie:
170 match hit:
171 case True{}:
172 cookie.age_ok(c, value, Http.digits.read(value))
173 case False{}:
174 cookie.named.domain(c, name, value, String.eq(name, "domain"))
175
176# Expires, stored as the HTTP-date text
177def cookie.named.expires(c: Cookie, +name: String, +value: String, hit: Bool)
178 -> Cookie:
179 match hit:
180 case True{}:
181 cookie.expires(c, value)
182 case False{}:
183 cookie.named.age(c, name, value, String.eq(name, "max-age"))
184
185# one name=value attribute
186def cookie.named(c: Cookie, +name: String, +value: String) -> Cookie:
187 cookie.named.expires(c, name, value, String.eq(name, "expires"))
188
189# one attribute piece, flag or name=value
190def cookie.apply.cut(c: Cookie, +piece: String, cut: Http.Cut) -> Cookie:
191 match cut:
192 case Http.NoCut{}:
193 cookie.flag(c, String.to_lower(String.trim(piece)))
194 case Http.Cut{before, after}:
195 cookie.named(c, String.to_lower(String.trim(before)), String.trim(after))
196
197# one semicolon-separated attribute
198def cookie.apply(c: Cookie, +piece: String) -> Cookie:
199 cookie.apply.cut(c, piece, Http.divide(piece, "="))
200
201# walk attributes. The list is the shrinking argument.
202def cookie.fold(ps: List<&2, String>, c: Cookie) -> Cookie:
203 match ps:
204 case []:
205 c
206 case h <> t:
207 cookie.fold(t, cookie.apply(c, String.trim(h)))
208
209# reject an empty name (RFC 6265 §4.1.1)
210def cookie.from.name(+name: String, value: String, attrs: List<&2, String>,
211 empty: Bool) -> Maybe<&2, Cookie>:
212 match empty:
213 case True{}:
214 None{}
215 case False{}:
216 Some{cookie.fold(attrs, cookie.new(name, value))}
217
218# the name=value pair, then the attribute list
219def cookie.from(_pair: String, attrs: List<&2, String>, cut: Http.Cut)
220 -> Maybe<&2, Cookie>:
221 match cut:
222 case Http.NoCut{}:
223 None{}
224 case Http.Cut{before, after}:
225 +name = String.trim(before)
226 cookie.from.name(name, String.trim(after), attrs, String.eq(name, ""))
227
228# Set-Cookie split on `;`
229def cookie.parse.parts(ps: List<&2, String>) -> Maybe<&2, Cookie>:
230 match ps:
231 case []:
232 None{}
233 case h <> t:
234 +pair = String.trim(h)
235 cookie.from(pair, t, Http.divide(pair, "="))
236
237# parse one Set-Cookie line (the field value, not the header name)
238def cookie.parse(line: String) -> Maybe<&2, Cookie>:
239 cookie.parse.parts(String.split(line, ';'))
240
241# `; Name=value` when value is present
242def cookie.opt.of(prefix: String, value: String, empty: Bool) -> String:
243 match empty:
244 case True{}:
245 ""
246 case False{}:
247 prefix ++ value
248
249# an optional attribute clause
250def cookie.opt(prefix: String, +value: String) -> String:
251 cookie.opt.of(prefix, value, String.eq(value, ""))
252
253# `; Domain=…` only when a Domain attribute was set
254def cookie.domain_text(domain: String, host_only: Bool) -> String:
255 match host_only:
256 case True{}:
257 ""
258 case False{}:
259 cookie.opt("; Domain=", domain)
260
261# `; Secure` / `; HttpOnly` when the flag is set
262def cookie.mark(label: String, on: Bool) -> String:
263 match on:
264 case False{}:
265 ""
266 case True{}:
267 "; " ++ label
268
269# Set-Cookie field value (RFC 6265 §4.1.1)
270def cookie.line(c: Cookie) -> String:
271 match c:
272 case Cookie{name, value, expires, max_age, domain, path, secure, http_only,
273 same_site, host_only}:
274 name ++ "=" ++ value
275 ++ cookie.opt("; Expires=", expires)
276 ++ cookie.opt("; Max-Age=", max_age)
277 ++ cookie.domain_text(domain, host_only)
278 ++ cookie.opt("; Path=", path)
279 ++ cookie.mark("Secure", secure)
280 ++ cookie.mark("HttpOnly", http_only)
281 ++ cookie.opt("; SameSite=", same_site)
282
283# a Set-Cookie header
284def cookie.set(c: Cookie) -> Http.Header:
285 Http.H{"Set-Cookie", cookie.line(c)}
286
287# keep name=value when the name is not empty
288def cookie.pairs.keep(name: String, value: String, empty: Bool,
289 rest: Unit -> List<&2, String>) -> List<&2, String>:
290 match empty:
291 case True{}:
292 rest(Unit{})
293 case False{}:
294 (name ++ "=" ++ value) <> rest(Unit{})
295
296# one cookie as a request pair, dropped when the name is empty
297def cookie.pairs.one(c: Cookie, rest: Unit -> List<&2, String>)
298 -> List<&2, String>:
299 match c:
300 case Cookie{+name, value, expires, max_age, domain, path, secure, http_only,
301 same_site, host_only}:
302 cookie.pairs.keep(name, value, String.eq(name, ""), rest)
303
304# name=value pieces, empty names removed
305def cookie.pairs(cs: List<&2, Cookie>) -> List<&2, String>:
306 match cs:
307 case []:
308 []
309 case h <> t:
310 cookie.pairs.one(h, _u => cookie.pairs(t))
311
312# Cookie field value: pairs joined by `; ` (RFC 6265 §5.4)
313def cookie.join(cs: List<&2, Cookie>) -> String:
314 String.join(cookie.pairs(cs), "; ")
315
316# a Cookie request header
317def cookie.request(cs: List<&2, Cookie>) -> Http.Header:
318 Http.H{"Cookie", cookie.join(cs)}
319
320# count `/` in a path
321def cookie.slashes.ch(slash: Bool, rest: Unit -> Nat) -> Nat:
322 match slash:
323 case False{}:
324 rest(Unit{})
325 case True{}:
326 Nat.add(1n, rest(Unit{}))
327
328# how many slashes a path holds
329def cookie.slashes(p: String) -> Nat:
330 match p:
331 case SNil{}:
332 0n
333 case SCon{h, t}:
334 cookie.slashes.ch(Char.is_eq(h, '/'), _u => cookie.slashes(t))
335
336# drop the reversed prefix through the first slash
337def cookie.skip.ch(hit: Bool, +tail: String, rest: Unit -> String) -> String:
338 match hit:
339 case True{}:
340 tail
341 case False{}:
342 rest(Unit{})
343
344# reversed path with the last segment removed
345def cookie.skip(p: String) -> String:
346 match p:
347 case SNil{}:
348 ""
349 case SCon{h, +t}:
350 cookie.skip.ch(Char.is_eq(h, '/'), t, _u => cookie.skip(t))
351
352# characters before the right-most slash
353def cookie.before(p: String) -> String:
354 String.reverse(cookie.skip(String.reverse(p)))
355
356# `/` when the path has fewer than two slashes, else the directory prefix
357def cookie.default_of(+p: String, few: Bool) -> String:
358 match few:
359 case True{}:
360 "/"
361 case False{}:
362 cookie.before(p)
363
364# default-path (RFC 6265 §5.1.4)
365def cookie.default_path(+p: String) -> String:
366 cookie.default_of(p, Nat.is_lt(cookie.slashes(p), 2n))
367
368# host-only cookies take the response host; Domain stays as parsed
369def cookie.fill_domain(domain: String, host_only: Bool, host: String) -> String:
370 match host_only:
371 case True{}:
372 host
373 case False{}:
374 domain
375
376# an absent Path becomes default-path
377def cookie.fill_path.of(path: String, req: String, empty: Bool) -> String:
378 match empty:
379 case True{}:
380 cookie.default_path(req)
381 case False{}:
382 path
383
384# an absent Path becomes default-path
385def cookie.fill_path(+path: String, req: String) -> String:
386 cookie.fill_path.of(path, req, String.eq(path, ""))
387
388# store the response host on a host-only cookie and fill default-path
389def cookie.receive(host: String, req_path: String, c: Cookie) -> Cookie:
390 match c:
391 case Cookie{name, value, expires, max_age, domain, path, secure, http_only,
392 same_site, +host_only}:
393 Cookie{name, value, expires, max_age,
394 cookie.fill_domain(domain, host_only, String.to_lower(host)),
395 cookie.fill_path(path, req_path), secure, http_only, same_site,
396 host_only}
397
398# a dot continues the scan, a digit keeps it, anything else stops
399def cookie.ipv4.step(dot: Bool, digit: Bool, if_dot: Unit -> Bool,
400 if_digit: Unit -> Bool) -> Bool:
401 match dot digit:
402 case True{} _:
403 if_dot(Unit{})
404 case False{} True{}:
405 if_digit(Unit{})
406 case False{} False{}:
407 False{}
408
409# true when the host is only digits and dots and contains a dot
410def cookie.ipv4.go(host: String, seen: Bool) -> Bool:
411 match host:
412 case SNil{}:
413 seen
414 case SCon{h, +t}:
415 +u = Char.to_u32(h)
416 cookie.ipv4.step(U32.is_eq(u, 46),
417 Bool.and(U32.is_ge(u, 48), U32.is_le(u, 57)),
418 _u => cookie.ipv4.go(t, True{}), _d => cookie.ipv4.go(t, seen))
419
420# IPv4 literal (no subdomain match, RFC 6265 §5.1.3)
421def cookie.ipv4(host: String) -> Bool:
422 cookie.ipv4.go(host, False{})
423
424# suffix match when the host is not an IPv4 address
425def cookie.domain_suffix(host: String, domain: String, ip: Bool) -> Bool:
426 match ip:
427 case True{}:
428 False{}
429 case False{}:
430 String.ends_with(host, "." ++ domain)
431
432# exact match, else the suffix rule
433def cookie.domain_eq(+host: String, +domain: String, same: Bool) -> Bool:
434 match same:
435 case True{}:
436 True{}
437 case False{}:
438 cookie.domain_suffix(host, domain, cookie.ipv4(host))
439
440# domain-match (RFC 6265 §5.1.3). Host and domain are compared lowercase.
441def cookie.domain_match(+host: String, +domain: String) -> Bool:
442 cookie.domain_eq(host, domain, String.eq(host, domain))
443
444# host-only is exact; a Domain attribute uses domain-match
445def cookie.domain_ok(host: String, domain: String, host_only: Bool) -> Bool:
446 match host_only:
447 case True{}:
448 String.eq(String.to_lower(host), String.to_lower(domain))
449 case False{}:
450 cookie.domain_match(String.to_lower(host), String.to_lower(domain))
451
452# the next request character is `/`, or the cookie-path already ended in `/`
453def cookie.path_slash(+req: String, +cpath: String, slash: Bool) -> Bool:
454 match slash:
455 case True{}:
456 True{}
457 case False{}:
458 String.starts_with(String.drop(req, String.length(cpath)), "/")
459
460# identical paths match; otherwise the prefix rules (RFC 6265 §5.1.4)
461def cookie.path_rest(+req: String, +cpath: String, same: Bool) -> Bool:
462 match same:
463 case True{}:
464 True{}
465 case False{}:
466 cookie.path_slash(req, cpath, String.ends_with(cpath, "/"))
467
468# path-match once the cookie-path is known to be a prefix
469def cookie.path_prefix(+req: String, +cpath: String, hit: Bool) -> Bool:
470 match hit:
471 case False{}:
472 False{}
473 case True{}:
474 cookie.path_rest(req, cpath, String.eq(req, cpath))
475
476# path-match (RFC 6265 §5.1.4)
477def cookie.path_ok(+req: String, +cpath: String) -> Bool:
478 cookie.path_prefix(req, cpath, String.starts_with(req, cpath))
479
480# Secure cookies ride only on TLS (RFC 6265 §5.4)
481def cookie.send.secure(tls: Bool, secure: Bool) -> Bool:
482 match secure:
483 case False{}:
484 True{}
485 case True{}:
486 tls
487
488# path-match, then the Secure bit
489def cookie.send.path(tls: Bool, secure: Bool, ok: Bool) -> Bool:
490 match ok:
491 case False{}:
492 False{}
493 case True{}:
494 cookie.send.secure(tls, secure)
495
496# domain-match, then path-match
497def cookie.send.domain(req: String, tls: Bool, secure: Bool, cpath: String,
498 ok: Bool) -> Bool:
499 match ok:
500 case False{}:
501 False{}
502 case True{}:
503 cookie.send.path(tls, secure, cookie.path_ok(req, cpath))
504
505# whether this cookie is sent on this request (RFC 6265 §5.4)
506def cookie.send(host: String, req_path: String, tls: Bool, c: Cookie) -> Bool:
507 match c:
508 case Cookie{name, value, expires, max_age, domain, path, secure, http_only,
509 same_site, host_only}:
510 cookie.send.domain(req_path, tls, secure, path,
511 cookie.domain_ok(host, domain, host_only))
512
513# no Max-Age means a session cookie (still sendable). 0 means already expired.
514def cookie.alive.of(age: Nat, m: Maybe<&2, Nat>) -> Bool:
515 match m:
516 case None{}:
517 True{}
518 case Some{n}:
519 Nat.is_lt(age, n)
520
521# Max-Age against an age in seconds. Expires is not compared to a clock.
522def cookie.alive(max_age: String, age: Nat) -> Bool:
523 cookie.alive.of(age, Http.digits.read(max_age))
524
525# cons when the cookie matches the request
526def cookie.select.cons(ok: Bool, c: Cookie, rest: Unit -> List<&2, Cookie>)
527 -> List<&2, Cookie>:
528 match ok:
529 case False{}:
530 rest(Unit{})
531 case True{}:
532 c <> rest(Unit{})
533
534# cookies that would be sent (domain, path, secure)
535def cookie.select(cs: List<&2, Cookie>, +host: String, +req_path: String,
536 +tls: Bool) -> List<&2, Cookie>:
537 match cs:
538 case []:
539 []
540 case +h <> t:
541 cookie.select.cons(cookie.send(host, req_path, tls, h), h,
542 _u => cookie.select(t, host, req_path, tls))