File Coverage

blib/lib/Plack/Middleware/SignedCookies.pm

Criterion	Covered	Total	%
statement	43	43	100.0
branch	18	20	90.0
condition	7	9	77.7
subroutine	11	11	100.0
pod	2	2	100.0
total	81	85	95.2

use 5.006; use strict; use warnings;

package Plack::Middleware::SignedCookies;
$Plack::Middleware::SignedCookies::VERSION = '1.202';
# ABSTRACT: accept only server-minted cookies

use parent 'Plack::Middleware';

use Plack::Util ();
use Plack::Util::Accessor qw( secret secure httponly );
use Digest::SHA ();

sub _hmac { y{+/}{-~}, return $_ for &Digest::SHA::hmac_sha256_base64 }

my $length = length _hmac 'something', 'something';

sub call {
	my ( $self, $env ) = ( shift, @_ );

	my $secret = $self->secret;

	local $env->{'HTTP_COOKIE'} =
		join '; ',
		grep { s/[ \t]*=[ \t]*/=/; s/[ \t]*([-~A-Za-z0-9]{$length})\z//o and $1 eq _hmac $_, $secret }
		map  { defined && /\A[ \t]*(.*[^ \t])/s ? split /[ \t]*;[ \t]*/, "$1" : () }
		$env->{'HTTP_COOKIE'};

	delete $env->{'HTTP_COOKIE'} if '' eq $env->{'HTTP_COOKIE'};

	return Plack::Util::response_cb( $self->app->( $env ), sub {
		my $do_sign;
		for ( @{ $_[0][1] } ) {
			if ( $do_sign ) {
				my $flags = s/(;.*)//s ? $1 : '';
				s/\A[ \t]+//, s/[ \t]+\z//, s/[ \t]*=[ \t]*|\z/=/; # normalise
				$_ .= ' ' . _hmac( $_, $secret ) . $flags;
				$_ .= '; secure'   if $self->secure   and $flags !~ /;[ \t]* secure   [ \t]* (?![^;])/ix;
				$_ .= '; HTTPonly' if $self->httponly and $flags !~ /;[ \t]* httponly [ \t]* (?![^;])/ix;
			}
			$do_sign = defined $do_sign ? undef : 'set-cookie' eq lc;
		}
	} );
}

sub prepare_app {
	my $self = shift;
	defined $self->httponly or $self->httponly( 1 );
	defined $self->secret   or $self->secret  ( join '', map { chr int rand 256 } 1..17 );
}

1;

__END__