Cookie expiration #5042

bmmcginty · 2017-09-26T22:08:21Z

As mentioned in #5033, this PR adds consistent handling for the expires parameter for cookies. It changes #expires to #expiration_time and allows #expires to act as a property for the expires parameter. It also adds #max_age to allow access to the max-age parameter. Finally, documentation has been added for #expiration_time.

Sija · 2017-09-26T22:56:36Z

spec/std/http/cookie_spec.cr

-        delta.should be > 9.seconds
-        delta.should be < 11.seconds
+        delta = cookie.max_age
+        delta.should eq 10.seconds


you could skip delta intermediary variable altogether since there's one call only.

Sija · 2017-09-26T22:56:44Z

spec/std/http/cookie_spec.cr

-        delta.should be > 0.seconds
-        delta.should be < 1.seconds
+        delta = cookie.max_age
+        delta.should eq 0.seconds


Sija · 2017-09-26T22:58:29Z

src/http/cookie.cr

@@ -42,9 +47,29 @@ module HTTP
      "#{@name}=#{URI.escape value}"
    end

+    # Returns the `Time` at which this cookie will expire, or `nil` if it will not expire.
+    # Uses *max-age* and *expires* values to ccalculate the time.


typo: ccalculate

Sija · 2017-09-27T12:56:32Z

spec/std/http/cookie_spec.cr

+
+    describe "expiration_time" do
+      it "by max-age=0" do
+        c = parse_set_cookie("bla=1; max-age=0")


c -> cookie plz

Sija · 2017-09-27T12:56:40Z

spec/std/http/cookie_spec.cr

+      end
+
+      it "by old date" do
+        c = parse_set_cookie("bla=1; expires=Thu, 01 Jan 1970 00:00:00 -0000")


Sija · 2017-09-27T12:57:07Z

src/http/cookie.cr

+    # Returns the `Time` at which this cookie will expire, or `nil` if it will not expire.
+    # Uses *max-age* and *expires* values to calculate the time.
+    def expiration_time
+      ma = @max_age


ma -> max_age

Sija · 2017-09-27T12:57:17Z

src/http/cookie.cr

+    # Uses *max-age* and *expires* values to calculate the time.
+    def expiration_time
+      ma = @max_age
+      ex = @expires


Sija · 2017-09-27T12:57:25Z

src/http/cookie.cr

    def expired?
-      if e = expires
-        e < Time.now
+      ma = @max_age


Sija · 2017-09-27T12:57:34Z

src/http/cookie.cr

-      if e = expires
-        e < Time.now
+      ma = @max_age
+      ex = @expires


Sija · 2017-10-05T22:12:13Z

src/http/cookie.cr

-                    parse_time(match["expires"]?)
-                  end
+        expires = parse_time(match["expires"]?)
+        max_age = match["max_age"]? ? match["max_age"].to_i.seconds : nil


max_age = match["max_age"]?.try(&.to_i.seconds)

This suggestion seems better than the current code.

straight-shoota · 2017-10-06T14:05:03Z

spec/std/http/cookie_spec.cr

+    describe "expiration_time" do
+      it "by max-age=0" do
+        cookie = parse_set_cookie("bla=1; max-age=0")
+        (cookie.expiration_time.not_nil! <= (Time.now + 1.seconds)).should eq true


eq true should be written as be_true in all specs.
And the tested value is probably better understandable as Time.now - cookie.expiration_time <= 1.seconds

straight-shoota · 2017-10-06T14:06:04Z

spec/std/http/cookie_spec.cr

+      end
+
+      it "not expired" do
+        (parse_set_cookie("bla=1; max-age=1").expiration_time.not_nil! > Time.now).should eq true


Please use a cookie variable like in the other examples. This makes it better readable.
The same goes for the following specs.

straight-shoota · 2017-10-06T14:08:02Z

spec/std/http/cookie_spec.cr

+        cookie.expiration_time.should eq Time.new(1970, 1, 1, 0, 0, 0)
+      end
+
+      it "not expired" do


It would be great to add more detail to the spec name, e.g. with max-age

straight-shoota · 2017-10-06T14:08:35Z

spec/std/http/cookie_spec.cr

+        (parse_set_cookie("bla=1; max-age=1").expiration_time.not_nil! > Time.now).should eq true
+      end
+
+      it "not expired" do


It would be great to add more detail to the spec name, e.g. with expires

straight-shoota · 2017-10-06T14:10:15Z

spec/std/http/cookie_spec.cr

+        (parse_set_cookie("bla=1; expires=Thu, 01 Jan 2020 00:00:00 -0000").expiration_time.not_nil! >= Time.new(2020, 1, 1, 0, 0, 0)).should eq true
+      end
+
+      it "not expired" do


It would be great to add more detail to the spec name, e.g. without expiration

straight-shoota · 2017-10-06T14:10:36Z

spec/std/http/cookie_spec.cr

+      end
+
+      it "not expired" do
+        parse_set_cookie("bla=1").expiration_time.should eq nil


eq nil => be_nil

straight-shoota · 2017-10-06T14:17:33Z

src/http/cookie.cr

    property domain : String?
    property secure : Bool
    property http_only : Bool
    property extension : String?
+    property creation_time : Time


I don't think it makes sense to have creation_time writable, and I'm not sure if it should even be readable externally.

To have a customizeable time reference, I would rather add an optional argument to expiration_time and expired?. It could be called current_time or time_reference. That would be a better API, because you don't need to change the Cookie's internal data to check its expiration at a certain point of time.

I think I set this up as you described, though I'm happy to rewrite. I added tests for using reference_time in specs as well, though the spec naming may be too verbose.

Looks good!

However on a second thought, it would probably make sense to have creation_time readable just to be transparent about it. And I'd also suggest to add creation_time as an optional named parameter to initialize. This allows for time-independent testing as well as (re-)creating a Cookie instance which was retrieved at a different point in time, maybe for serialization.
I think it makes generally sense to allow all references to Time.new to be replaced with an optional parameter. So maybe even expired? should get a second, optional named parameter...

straight-shoota · 2017-10-06T14:23:21Z

src/http/cookie.cr

+    # Returns the `Time` at which this cookie will expire, or `nil` if it will not expire.
+    # Uses *max-age* and *expires* values to calculate the time.
+    def expiration_time
+      max_age = @max_age


I'd suggest to move the variable assignment into the condition.
The elsif branch is unnecessary because @expires is either nil or Time and this is what this method returns.

if max_age = @max_age creation_time + max_age else @expires end

straight-shoota · 2017-10-06T14:31:21Z

src/http/cookie.cr

    def expired?
-      if e = expires
-        e < Time.now
+      max_age = @max_age


This method has duplicated code from expiration_time and should use that method instead. This way it becomes very simple:

@max_age == 0.seconds || expiration_time.try &.<(Time.now) || false

straight-shoota · 2017-10-09T10:25:14Z

src/http/cookie.cr

-      elsif expires
-        expires
+    # By default, this function uses the creation time of this cookie as the offset for max-age, if max-age is set.
+    # To use a different offset, provide a `Time` object to *time_Reference*.


Just a small typo: time_reference

straight-shoota · 2017-10-09T10:37:16Z

spec/std/http/cookie_spec.cr

+    describe "expiration_time" do
+      it "sets expiration_time to be current when max-age=0" do
+        cookie = parse_set_cookie("bla=1; max-age=0")
+        (Time.now - cookie.expiration_time.not_nil! <= 1.seconds).should be_true


This could even be written (Time.now - cookie.expiration_time.not_nil!).should be.<= 1.seconds

I just learned about this ;)

straight-shoota · 2017-10-10T08:34:48Z

spec/std/http/cookie_spec.cr

+    describe "expiration_time" do
+      it "sets expiration_time to be current when max-age=0" do
+        cookie = parse_set_cookie("bla=1; max-age=0")
+        (Time.now - cookie.expiration_time.not_nil!).should be.<= 1.seconds


I'm really sorry that I my suggestion was a bit inprecise. 😢 I don't know why I assumed the period to be necessary...

be <= 1.seconds works as well and reads much better.

Will fix. No problem; I could have looked through more docs myself.

straight-shoota · 2017-10-10T08:35:48Z

Great work! Unfortunately, I was misleading you about the proper syntax for comparison expectations. Sorry about that :/

jkthorne · 2018-06-12T23:43:14Z

src/http/cookie.cr

      domain = @domain
      String.build do |header|
        header << "#{URI.escape @name}=#{URI.escape value}"
        header << "; domain=#{domain}" if domain
        header << "; path=#{path}" if path
        header << "; expires=#{HTTP.rfc1123_date(expires)}" if expires
+        header << "; max-age=#{max_age.total_seconds}" if max_age


I think + is preferred in string concatenation.
before:

header << "; max-age=#{max_age.total_seconds}" if max_age

after:

header << "; max-age=" + max_age.total_seconds if max_age

Seems like the rest of the headers are in the other style so this is not a change is not necessary with this PR.

No, + is discouraged. Maybe << would be slightly faster, but interpolation is totally fine.

In that case this is good.

jkthorne · 2018-06-12T23:44:05Z

@bmmcginty what is the status on this PR? I am just curious it looks pretty good to me.

RX14 · 2018-06-15T10:46:03Z

src/http/cookie.cr

      end
    end

+    def expired?(time_reference = @creation_time)
+      @max_age == 0.seconds || expiration_time(time_reference).try &.<(Time.now) || false


Why || false?

I'd prefer

time = expiration_time(time_reference) @max_age == 0.seconds || (time && time < Time.now)

@max_age == 0.seconds || (time = expiration_time(time_reference) && time < Time.now)

Avoids calculation of expiration_time if the first condition is already true.

Sija · 2018-06-15T14:26:49Z

src/http/cookie.cr

-        header << "; expires=#{HTTP.rfc1123_date(expires)}" if expires
-        header << "; max-age=#{max_age.total_seconds}" if max_age
+        header << "; expires=#{HTTP.format_time(expires)}" if expires
+        xheader << "; max-age=#{max_age.total_seconds}" if max_age


bmmcginty · 2018-06-15T17:06:49Z

Typo. Should be corrected by the latest push.

…

On Fri, Jun 15, 2018 at 07:27:07AM -0700, Sijawusz Pur Rahnama wrote: ***@***.***** commented on this pull request. ---- In [src/http/cookie.cr](http://go.bmcginty.us/213788) : > @@ -35,8 +35,8 @@ module HTTP header << "#{URI.escape @name}=#{URI.escape value}" header << "; domain=#{domain}" if domain header << "; path=#{path}" if path - header << "; expires=#{HTTP.rfc1123_date(expires)}" if expires - header << "; max-age=#{max_age.total_seconds}" if max_age + header << "; expires=#{HTTP.format_time(expires)}" if expires + xheader << "; max-age=#{max_age.total_seconds}" if max_age xheader ? — You are receiving this because you were mentioned. Reply to this email directly, [view it on GitHub](http://go.bmcginty.us/213787) , or [mute the thread](http://go.bmcginty.us/213789) .![]

RX14

And spec failed

RX14 · 2018-06-19T00:09:31Z

src/http/cookie.cr

      end
    end

+    # returns the expiration status of this cookie as a `Bool` given a creation time


Returns true if this cookie is expired.
Uses max-age and expires values to calculate the time.
By default, this function uses the creation time of this cookie as the offset for max-age, if max-age is set.
To use a different offset, provide a Time object to time_reference.

bmmcginty · 2018-06-19T03:24:42Z

I'd like to say this has been rebased to match the master branch. At this point, though, I haven't a clue.

straight-shoota · 2018-06-19T08:04:32Z

It seems like you lost the specs and some code in cookie.cr at some point during rebasing.

Sija · 2018-06-19T10:40:07Z

@bmmcginty ac6a53e could be a recovery starting point.

straight-shoota · 2019-07-24T10:18:48Z

Closed in favour of #7925

Sija reviewed Sep 26, 2017

View reviewed changes

Sija reviewed Sep 27, 2017

View reviewed changes

src/http/cookie.cr Outdated

def expired?

if e = expires

e < Time.now

ma = @max_age

Copy link

Contributor

Sija Sep 27, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ditto

Sija reviewed Sep 27, 2017

View reviewed changes

src/http/cookie.cr Outdated

if e = expires

e < Time.now

ma = @max_age

ex = @expires

Copy link

Contributor

Sija Sep 27, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ditto

Sija reviewed Oct 5, 2017

View reviewed changes

RX14 added breaking-change kind:feature topic:stdlib labels Oct 6, 2017

straight-shoota requested changes Oct 6, 2017

View reviewed changes

straight-shoota reviewed Oct 9, 2017

View reviewed changes

straight-shoota reviewed Oct 10, 2017

View reviewed changes

jkthorne reviewed Jun 12, 2018

View reviewed changes

bmmcginty force-pushed the cookie_expiration branch 2 times, most recently from 74f9181 to e2e9b28 Compare June 15, 2018 02:42

RX14 reviewed Jun 15, 2018

View reviewed changes

Sija reviewed Jun 15, 2018

View reviewed changes

RX14 requested changes Jun 19, 2018

View reviewed changes

bmmcginty force-pushed the cookie_expiration branch from fc8c27e to 354bc8c Compare June 19, 2018 03:19

setup propper handling of max-age and expires for cookies

aae5f30

bmmcginty force-pushed the cookie_expiration branch from 354bc8c to aae5f30 Compare June 19, 2018 17:34

straight-shoota added the pr:needs-work A PR requires modifications by the author. label Feb 15, 2019

watzon mentioned this pull request Jun 26, 2019

Proper handling of max-age and expires for cookies #7925

Closed

RX14 closed this Jul 16, 2019

Cookie expiration #5042

Cookie expiration #5042

Conversation

bmmcginty commented Sep 26, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Sija Sep 26, 2017 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

straight-shoota commented Oct 10, 2017

jkthorne Jun 12, 2018 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jkthorne commented Jun 12, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bmmcginty commented Jun 15, 2018 via email

RX14 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bmmcginty commented Jun 19, 2018

straight-shoota commented Jun 19, 2018

Sija commented Jun 19, 2018

straight-shoota commented Jul 24, 2019

Sija Sep 26, 2017 •

edited

jkthorne Jun 12, 2018 •

edited