File Coverage

blib/lib/Plack/Middleware/SignedCookies.pm

Criterion	Covered	Total	%
statement	43	43	100.0
branch	9	10	90.0
condition	13	17	76.4
subroutine	10	10	100.0
pod	1	1	100.0
total	76	81	93.8

use 5.010;
use strict;
use warnings;

package Plack::Middleware::SignedCookies;
$Plack::Middleware::SignedCookies::VERSION = '1.103';
# ABSTRACT: accept only server-minted cookies

use parent 'Plack::Middleware';

use Plack::Util ();
use Plack::Util::Accessor qw( secret secure httponly );
use Digest::SHA ();

sub _hmac { y{+/}{-~}, return $_ for Digest::SHA::hmac_sha256_base64( @_[0,1] ) }

my $length = length _hmac 'something', 'something';

sub call {
	my $self = shift;
	my $env  = shift;

	my $secure   = $self->secure   // do { $self->secure  ( 0 ) };
	my $httponly = $self->httponly // do { $self->httponly( 1 ) };
	my $secret   = $self->secret
		// do { $self->secret( join '', map { chr int rand 256 } 1..17 ) };

	my $cookie =
		join '; ',
		grep { s/(.{$length})\z//o and $1 eq _hmac $_, $secret }
		split /\s*[;,]\s*/,
		$env->{'HTTP_COOKIE'} // '';

	length $cookie
		? local $env->{'HTTP_COOKIE'} = $cookie
		: delete local $env->{'HTTP_COOKIE'};

	return Plack::Util::response_cb( $self->app->( $env ), sub {
		my ( $i, $headers ) = ( 0, $_[0][1] );
		while ( $i < $#$headers ) {
			++$i, next if 'set-cookie' ne lc $headers->[$i++];
			for ( $headers->[$i++] ) {
				s!\A\s*([^;]+?)\K\s*(?=;|\z)!_hmac $1, $secret!e;
				$_ .= '; secure'   if $secure   and not /;\s* secure   \s* (?:;|\z)/ix;
				$_ .= '; HTTPonly' if $httponly and not /;\s* httponly \s* (?:;|\z)/ix;
			}
		}
	} );
}

1;

__END__