You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
98 lines
3.6 KiB
98 lines
3.6 KiB
<?php |
|
/** |
|
* @link http://www.yiiframework.com/ |
|
* @copyright Copyright (c) 2008 Yii Software LLC |
|
* @license http://www.yiiframework.com/license/ |
|
*/ |
|
|
|
namespace yii\web; |
|
|
|
/** |
|
* Cookie represents information related with a cookie, such as [[name]], [[value]], [[domain]], etc. |
|
* |
|
* For more details and usage information on Cookie, see the [guide article on handling cookies](guide:runtime-sessions-cookies). |
|
* |
|
* @author Qiang Xue <qiang.xue@gmail.com> |
|
* @since 2.0 |
|
*/ |
|
class Cookie extends \yii\base\BaseObject |
|
{ |
|
/** |
|
* SameSite policy Lax will prevent the cookie from being sent by the browser in all cross-site browsing context |
|
* during CSRF-prone request methods (e.g. POST, PUT, PATCH etc). |
|
* E.g. a POST request from https://otherdomain.com to https://yourdomain.com will not include the cookie, however a GET request will. |
|
* When a user follows a link from https://otherdomain.com to https://yourdomain.com it will include the cookie |
|
* @see $sameSite |
|
*/ |
|
const SAME_SITE_LAX = 'Lax'; |
|
/** |
|
* SameSite policy Strict will prevent the cookie from being sent by the browser in all cross-site browsing context |
|
* regardless of the request method and even when following a regular link. |
|
* E.g. a GET request from https://otherdomain.com to https://yourdomain.com or a user following a link from |
|
* https://otherdomain.com to https://yourdomain.com will not include the cookie. |
|
* @see $sameSite |
|
*/ |
|
const SAME_SITE_STRICT = 'Strict'; |
|
|
|
/** |
|
* @var string name of the cookie |
|
*/ |
|
public $name; |
|
/** |
|
* @var string value of the cookie |
|
*/ |
|
public $value = ''; |
|
/** |
|
* @var string domain of the cookie |
|
*/ |
|
public $domain = ''; |
|
/** |
|
* @var int the timestamp at which the cookie expires. This is the server timestamp. |
|
* Defaults to 0, meaning "until the browser is closed". |
|
*/ |
|
public $expire = 0; |
|
/** |
|
* @var string the path on the server in which the cookie will be available on. The default is '/'. |
|
*/ |
|
public $path = '/'; |
|
/** |
|
* @var bool whether cookie should be sent via secure connection |
|
*/ |
|
public $secure = false; |
|
/** |
|
* @var bool whether the cookie should be accessible only through the HTTP protocol. |
|
* By setting this property to true, the cookie will not be accessible by scripting languages, |
|
* such as JavaScript, which can effectively help to reduce identity theft through XSS attacks. |
|
*/ |
|
public $httpOnly = true; |
|
/** |
|
* @var string SameSite prevents the browser from sending this cookie along with cross-site requests. |
|
* Please note that this feature is only supported since PHP 7.3.0 |
|
* For better security, an exception will be thrown if `sameSite` is set while using an unsupported version of PHP. |
|
* To use this feature across different PHP versions check the version first. E.g. |
|
* ```php |
|
* $cookie->sameSite = PHP_VERSION_ID >= 70300 ? yii\web\Cookie::SAME_SITE_LAX : null, |
|
* ``` |
|
* See https://www.owasp.org/index.php/SameSite for more information about sameSite. |
|
* |
|
* @since 2.0.21 |
|
*/ |
|
public $sameSite; |
|
|
|
|
|
/** |
|
* Magic method to turn a cookie object into a string without having to explicitly access [[value]]. |
|
* |
|
* ```php |
|
* if (isset($request->cookies['name'])) { |
|
* $value = (string) $request->cookies['name']; |
|
* } |
|
* ``` |
|
* |
|
* @return string The value of the cookie. If the value property is null, an empty string will be returned. |
|
*/ |
|
public function __toString() |
|
{ |
|
return (string) $this->value; |
|
} |
|
}
|
|
|