mirror of
https://github.com/yiisoft/yii2.git
synced 2025-10-31 10:39:59 +08:00
99 lines
3.6 KiB
PHP
99 lines
3.6 KiB
PHP
<?php
|
|
/**
|
|
* @link http://www.yiiframework.com/
|
|
* @copyright Copyright (c) 2008 Yii Software LLC
|
|
* @license http://www.yiiframework.com/license/
|
|
*/
|
|
|
|
namespace yii\web;
|
|
|
|
/**
|
|
* Cookie represents information related with a cookie, such as [[name]], [[value]], [[domain]], etc.
|
|
*
|
|
* For more details and usage information on Cookie, see the [guide article on handling cookies](guide:runtime-sessions-cookies).
|
|
*
|
|
* @author Qiang Xue <qiang.xue@gmail.com>
|
|
* @since 2.0
|
|
*/
|
|
class Cookie extends \yii\base\BaseObject
|
|
{
|
|
/**
|
|
* SameSite policy Lax will prevent the cookie from being sent by the browser in all cross-site browsing context
|
|
* during CSRF-prone request methods (e.g. POST, PUT, PATCH etc).
|
|
* E.g. a POST request from https://otherdomain.com to https://yourdomain.com will not include the cookie, however a GET request will.
|
|
* When a user follows a link from https://otherdomain.com to https://yourdomain.com it will include the cookie
|
|
* @see $sameSite
|
|
*/
|
|
const SAME_SITE_LAX = 'Lax';
|
|
/**
|
|
* SameSite policy Strict will prevent the cookie from being sent by the browser in all cross-site browsing context
|
|
* regardless of the request method and even when following a regular link.
|
|
* E.g. a GET request from https://otherdomain.com to https://yourdomain.com or a user following a link from
|
|
* https://otherdomain.com to https://yourdomain.com will not include the cookie.
|
|
* @see $sameSite
|
|
*/
|
|
const SAME_SITE_STRICT = 'Strict';
|
|
|
|
/**
|
|
* @var string name of the cookie
|
|
*/
|
|
public $name;
|
|
/**
|
|
* @var string value of the cookie
|
|
*/
|
|
public $value = '';
|
|
/**
|
|
* @var string domain of the cookie
|
|
*/
|
|
public $domain = '';
|
|
/**
|
|
* @var int the timestamp at which the cookie expires. This is the server timestamp.
|
|
* Defaults to 0, meaning "until the browser is closed".
|
|
*/
|
|
public $expire = 0;
|
|
/**
|
|
* @var string the path on the server in which the cookie will be available on. The default is '/'.
|
|
*/
|
|
public $path = '/';
|
|
/**
|
|
* @var bool whether cookie should be sent via secure connection
|
|
*/
|
|
public $secure = false;
|
|
/**
|
|
* @var bool whether the cookie should be accessible only through the HTTP protocol.
|
|
* By setting this property to true, the cookie will not be accessible by scripting languages,
|
|
* such as JavaScript, which can effectively help to reduce identity theft through XSS attacks.
|
|
*/
|
|
public $httpOnly = true;
|
|
/**
|
|
* @var string SameSite prevents the browser from sending this cookie along with cross-site requests.
|
|
* Please note that this feature is only supported since PHP 7.3.0
|
|
* For better security, an exception will be thrown if `sameSite` is set while using an unsupported version of PHP.
|
|
* To use this feature across different PHP versions check the version first. E.g.
|
|
* ```php
|
|
* $cookie->sameSite = PHP_VERSION_ID >= 70300 ? yii\web\Cookie::SAME_SITE_LAX : null,
|
|
* ```
|
|
* See https://www.owasp.org/index.php/SameSite for more information about sameSite.
|
|
*
|
|
* @since 2.0.21
|
|
*/
|
|
public $sameSite;
|
|
|
|
|
|
/**
|
|
* Magic method to turn a cookie object into a string without having to explicitly access [[value]].
|
|
*
|
|
* ```php
|
|
* if (isset($request->cookies['name'])) {
|
|
* $value = (string) $request->cookies['name'];
|
|
* }
|
|
* ```
|
|
*
|
|
* @return string The value of the cookie. If the value property is null, an empty string will be returned.
|
|
*/
|
|
public function __toString()
|
|
{
|
|
return (string) $this->value;
|
|
}
|
|
}
|