1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
use strict;
use Plack::Test;
use Plack::Middleware::Session::Cookie;
use Test::More;
use HTTP::Request::Common;
use HTTP::Cookies;
my $app = sub {
my $env = shift;
$env->{'psgix.session'}->{counter} = 1;
my $path = $env->{PATH_INFO} =~ /with_path/ ? "/foo" : undef;
$env->{'psgix.session.options'}{path} = $path;
$env->{'psgix.session.options'}{domain} = '.example.com';
return [ 200, [], [ "Hi" ] ];
};
$app = Plack::Middleware::Session::Cookie->wrap(
$app,
secret => 'foobar',
httponly => 1,
samesite => 'Lax',
);
test_psgi $app, sub {
my $cb = shift;
my $res = $cb->(GET "http://localhost/");
like $res->header('Set-Cookie'), qr/plack_session=\S+; domain=.example.com; SameSite=Lax; HttpOnly/;
$res = $cb->(GET "http://localhost/with_path");
like $res->header('Set-Cookie'), qr/plack_session=\S+; domain=.example.com; path=\/foo; SameSite=Lax; HttpOnly/;
};
# Partitioned Cookies
# https://developer.mozilla.org/en-US/docs/Web/Privacy/Privacy_sandbox/Partitioned_cookies
$app = Plack::Middleware::Session::Cookie->wrap(
$app,
secret => 'foobar',
httponly => 1,
partitioned => 1
);
test_psgi $app, sub {
my $cb = shift;
# Partitioned cookies are secure, and always have SameSite=None
# Lowercase "secure" provided by Cookie::Baker when using Partitioned.
my $res = $cb->(GET "http://localhost/");
like $res->header('Set-Cookie'), qr/plack_session=\S+; domain=.example.com; SameSite=None; secure; HttpOnly; Partitioned/;
$res = $cb->(GET "http://localhost/with_path");
like $res->header('Set-Cookie'), qr/plack_session=\S+; domain=.example.com; path=\/foo; SameSite=None; secure; HttpOnly; Partitioned/;
};
done_testing;
|
