api_nilorea/ex_http_cookie_8c-example.html

/*

 * Nilorea Library

 * Copyright (C) 2005-2026 Castagnier Mickael

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

 * implied. See the License for the specific language governing

 * permissions and limitations under the License.

 *

 * SPDX-License-Identifier: Apache-2.0

 */


#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <unistd.h>


#include "nilorea/n_common.h"

#include "nilorea/n_http_cookie.h"

#include "nilorea/n_log.h"

#include "nilorea/n_str.h"


static int log_level = LOG_ERR;

static int failures = 0;


static void expect_true(const char* what, int ok) {

    if (!ok) {

        n_log(LOG_ERR, "FAIL: %s", what);

        failures++;

    } else {

        n_log(LOG_INFO, "ok: %s", what);

    }

}


static int process_args(int argc, char** argv) {

    int opt = 0;


    while ((opt = getopt(argc, argv, "V:")) != -1) {

        if (opt == 'V') {

            log_level = atoi(optarg);

        } else {

            return -1;

        }

    }

    return 0;

}


static int cookie_is(const char* header, const char* name, const char* want) {

    size_t vl = 99;

    const char* v = n_http_cookie_get(header, strlen(header), name, &vl);

    if (!want)

        return v == NULL && vl == 0;

    return v && vl == strlen(want) && memcmp(v, want, vl) == 0;

}


static void test_read(void) {

    const char* h = "a=first; b=x%41;a=second; c=\"q\"; bad name=1; =v; d;  e = spaced ;;f=";


    expect_true("first occurrence wins", cookie_is(h, "a", "first"));

    expect_true("both occurrences counted", n_http_cookie_count(h, strlen(h), "a") == 2);

    expect_true("value kept raw (percent escape)", cookie_is(h, "b", "x%41"));

    expect_true("value kept raw (quotes)", cookie_is(h, "c", "\"q\""));

    expect_true("pair with a non-token name skipped", cookie_is(h, "bad name", NULL) && cookie_is(h, "name", NULL));

    expect_true("pair without '=' has an empty value", cookie_is(h, "d", ""));

    expect_true("spaces around name and value trimmed", cookie_is(h, "e", "spaced"));

    expect_true("empty value", cookie_is(h, "f", ""));

    expect_true("absent cookie", cookie_is(h, "zz", NULL));

    expect_true("names are case-sensitive", cookie_is(h, "A", NULL));

    expect_true("a name prefix does not match", cookie_is("abc=1", "ab", NULL));

    expect_true("__Host- name found", cookie_is("__Host-nsid=abc123; other=1", "__Host-nsid", "abc123"));

    expect_true("empty header", cookie_is("", "a", NULL));

    expect_true("NULL header", n_http_cookie_get(NULL, 0, "a", NULL) == NULL && n_http_cookie_count(NULL, 0, "a") == 0);

    expect_true("empty name", n_http_cookie_get("a=1", 3, "", NULL) == NULL);

}


static int builds(const N_HTTP_SET_COOKIE* c, const char* want) {

    N_STR* out = NULL;

    int ok = n_http_set_cookie_build(&out, c);

    int res = want ? (ok == TRUE && out && strcmp(out->data, want) == 0) : (ok == FALSE && out == NULL);

    if (!res)

        n_log(LOG_ERR, "got: %s", out ? out->data : "(nothing)");

    free_nstr(&out);

    return res;

}


static void test_build(void) {

    N_HTTP_SET_COOKIE c;

    N_STR* out = NULL;


    memset(&c, 0, sizeof(c));

    c.name = "__Host-nsid";

    c.value = "AbC-123_x";

    c.path = "/";

    c.max_age = N_HTTP_COOKIE_SESSION;

    c.secure = 1;

    c.http_only = 1;

    c.same_site = N_HTTP_SAMESITE_LAX;

    expect_true("session cookie, as the site sends it",

                builds(&c, "__Host-nsid=AbC-123_x; Path=/; Secure; HttpOnly; SameSite=Lax"));

    c.max_age = 0;

    c.value = "";

    expect_true("deletion",

                builds(&c, "__Host-nsid=; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=/; Secure; HttpOnly; SameSite=Lax"));

    c.max_age = 3600;

    c.same_site = N_HTTP_SAMESITE_STRICT;

    expect_true("Max-Age and Strict", builds(&c, "__Host-nsid=; Max-Age=3600; Path=/; Secure; HttpOnly; SameSite=Strict"));


    memset(&c, 0, sizeof(c));

    c.name = "pref";

    c.value = "dark";

    c.max_age = N_HTTP_COOKIE_SESSION;

    c.domain = "example.org";

    c.path = "/a b";

    expect_true("plain cookie with Domain, no flags", builds(&c, "pref=dark; Path=/a b; Domain=example.org"));


    /* injection and invalid values */

    c.domain = NULL;

    c.path = NULL;

    c.value = "a;b";

    expect_true("';' in a value refused", builds(&c, NULL));

    c.value = "a\r\nSet-Cookie: x=1";

    expect_true("CRLF in a value refused", builds(&c, NULL));

    c.value = "a b";

    expect_true("space in a value refused", builds(&c, NULL));

    c.value = "\"q\"";

    expect_true("quotes in a value refused", builds(&c, NULL));

    c.value = "ok";

    c.name = "a=b";

    expect_true("'=' in a name refused", builds(&c, NULL));

    c.name = "";

    expect_true("empty name refused", builds(&c, NULL));

    c.name = NULL;

    expect_true("NULL name refused", builds(&c, NULL));

    c.name = "ok";

    c.path = "/x;Domain=evil";

    expect_true("';' in a path refused", builds(&c, NULL));

    c.path = "/x\n";

    expect_true("control byte in a path refused", builds(&c, NULL));

    c.path = "";

    expect_true("empty path refused", builds(&c, NULL));

    c.path = NULL;

    c.domain = "evil.org; Secure";

    expect_true("bad domain refused", builds(&c, NULL));

    c.domain = NULL;

    c.max_age = -5;

    expect_true("negative Max-Age refused", builds(&c, NULL));

    c.max_age = N_HTTP_COOKIE_SESSION;

    c.same_site = N_HTTP_SAMESITE_NONE;

    expect_true("SameSite=None without Secure refused", builds(&c, NULL));

    c.secure = 1;

    expect_true("SameSite=None with Secure", builds(&c, "ok=ok; Secure; SameSite=None"));

    c.same_site = (N_HTTP_SAMESITE)7;

    expect_true("unknown SameSite refused", builds(&c, NULL));

    c.same_site = N_HTTP_SAMESITE_UNSET;


    /* cookie prefixes */

    c.name = "__Host-x";

    c.path = "/";

    c.secure = 0;

    expect_true("__Host- without Secure refused", builds(&c, NULL));

    c.secure = 1;

    c.path = "/admin";

    expect_true("__Host- with Path other than / refused", builds(&c, NULL));

    c.path = NULL;

    expect_true("__Host- without Path refused", builds(&c, NULL));

    c.path = "/";

    c.domain = "example.org";

    expect_true("__Host- with Domain refused", builds(&c, NULL));

    c.domain = NULL;

    c.name = "__Secure-x";

    c.secure = 0;

    expect_true("__Secure- without Secure refused", builds(&c, NULL));

    c.secure = 1;

    expect_true("__Secure- with Secure", builds(&c, "__Secure-x=ok; Path=/; Secure"));


    /* appends; a refused cookie leaves the destination unchanged */

    out = char_to_nstr("X: ");

    c.name = "a";

    c.path = NULL;

    c.secure = 0;

    expect_true("append", n_http_set_cookie_build(&out, &c) == TRUE && strcmp(out->data, "X: a=ok") == 0);

    c.value = "b;c";

    expect_true("refused append returns FALSE", n_http_set_cookie_build(&out, &c) == FALSE);

    expect_true("refused append leaves the destination", strcmp(out->data, "X: a=ok") == 0);

    free_nstr(&out);

    expect_true("NULL arguments", n_http_set_cookie_build(NULL, &c) == FALSE && n_http_set_cookie_build(&out, NULL) == FALSE);

}


int main(int argc, char** argv) {

    if (process_args(argc, argv) != 0) {

        fprintf(stderr, "usage: %s [-V LOG_LEVEL]\n", argv[0]);

        return 1;

    }

    set_log_level(log_level);


    test_read();

    test_build();


    if (failures) {

        n_log(LOG_ERR, "ex_http_cookie: %d failure(s)", failures);

        return 1;

    }

    n_log(LOG_NOTICE, "ex_http_cookie: all checks passed");

    return 0;

}

process_args
void process_args(int argc, char **argv)
Definition ex_allegro_4.c:55

failures
static int failures
Definition ex_atlas.c:51

main
int main(void)
Definition ex_atlas.c:117

expect_true
static void expect_true(const char *label, int cond)
Definition ex_atlas.c:53

log_level
static int log_level
Definition ex_disk_cache.c:40

test_build
static void test_build(void)
building Set-Cookie values
Definition ex_http_cookie.c:123

cookie_is
static int cookie_is(const char *header, const char *name, const char *want)
the cookie name in header has exactly the value want (NULL: absent)
Definition ex_http_cookie.c:79

test_read
static void test_read(void)
reading a Cookie header
Definition ex_http_cookie.c:88

builds
static int builds(const N_HTTP_SET_COOKIE *c, const char *want)
build one Set-Cookie and compare
Definition ex_http_cookie.c:112

h
static int h(void *ctx, const N_ROUTE_MATCH *m)
a handler that does nothing (the test only routes)
Definition ex_http_router.c:77

n_log
#define n_log(__LEVEL__,...)
Logging function wrapper to get line and func.
Definition n_log.h:113

LOG_ERR
#define LOG_ERR
error conditions
Definition n_log.h:100

set_log_level
void set_log_level(const int log_level)
Set the global log level value ( static int LOG_LEVEL ).
Definition n_log.c:123

LOG_NOTICE
#define LOG_NOTICE
normal but significant condition
Definition n_log.h:104

LOG_INFO
#define LOG_INFO
informational
Definition n_log.h:106

N_HTTP_SET_COOKIE::http_only
int http_only
non-zero: HttpOnly
Definition n_http_cookie.h:80

N_HTTP_SET_COOKIE::value
const char * value
cookie value, RFC 6265 cookie-octets only (may be "")
Definition n_http_cookie.h:69

N_HTTP_SET_COOKIE::secure
int secure
non-zero: Secure
Definition n_http_cookie.h:78

N_HTTP_SET_COOKIE::path
const char * path
Path attribute, or NULL.
Definition n_http_cookie.h:71

N_HTTP_SET_COOKIE::name
const char * name
cookie name, an RFC 9110 token
Definition n_http_cookie.h:67

N_HTTP_SET_COOKIE::domain
const char * domain
Domain attribute, or NULL (host-only cookie).
Definition n_http_cookie.h:73

N_HTTP_SET_COOKIE::same_site
N_HTTP_SAMESITE same_site
SameSite attribute.
Definition n_http_cookie.h:82

N_HTTP_SET_COOKIE::max_age
long long max_age
Max-Age in seconds; N_HTTP_COOKIE_SESSION for a session cookie; 0 deletes the cookie (Max-Age=0 plus ...
Definition n_http_cookie.h:76

n_http_cookie_count
size_t n_http_cookie_count(const char *header, size_t len, const char *name)
count the pairs named name in a Cookie header value
Definition n_http_cookie.c:131

N_HTTP_SAMESITE
N_HTTP_SAMESITE
SameSite attribute of a Set-Cookie.
Definition n_http_cookie.h:54

n_http_set_cookie_build
int n_http_set_cookie_build(N_STR **out, const N_HTTP_SET_COOKIE *c)
append a Set-Cookie header value, refusing anything that could break out of an attribute or that a br...
Definition n_http_cookie.c:167

N_HTTP_COOKIE_SESSION
#define N_HTTP_COOKIE_SESSION
Max-Age value meaning "session cookie": neither Max-Age nor Expires is sent.
Definition n_http_cookie.h:62

n_http_cookie_get
const char * n_http_cookie_get(const char *header, size_t len, const char *name, size_t *value_len)
find a cookie in a Cookie header value (first occurrence wins)
Definition n_http_cookie.c:110

N_HTTP_SAMESITE_NONE
@ N_HTTP_SAMESITE_NONE
SameSite=None, needs Secure.
Definition n_http_cookie.h:58

N_HTTP_SAMESITE_STRICT
@ N_HTTP_SAMESITE_STRICT
SameSite=Strict.
Definition n_http_cookie.h:57

N_HTTP_SAMESITE_LAX
@ N_HTTP_SAMESITE_LAX
SameSite=Lax.
Definition n_http_cookie.h:56

N_HTTP_SAMESITE_UNSET
@ N_HTTP_SAMESITE_UNSET
no SameSite attribute (browser default)
Definition n_http_cookie.h:55

N_HTTP_SET_COOKIE
what a Set-Cookie should carry
Definition n_http_cookie.h:65

N_STR::data
char * data
the string
Definition n_str.h:63

free_nstr
#define free_nstr(__ptr)
free a N_STR structure and set the pointer to NULL
Definition n_str.h:203

char_to_nstr
N_STR * char_to_nstr(const char *src)
Convert a char into a N_STR, short version.
Definition n_str.c:262

N_STR
A box including a string and his lenght.
Definition n_str.h:61

n_common.h
Common headers and low-level functions & define.

n_http_cookie.h
Server-side cookies: read a Cookie header, build a Set-Cookie value.

n_log.h
Generic log system.

n_str.h
N_STR and string function declaration.