001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing,
013 * software distributed under the License is distributed on an
014 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015 * KIND, either express or implied.  See the License for the
016 * specific language governing permissions and limitations
017 * under the License.
018 */
019package org.apache.shiro.web.servlet;
020
021import javax.servlet.http.HttpServletRequest;
022import javax.servlet.http.HttpServletResponse;
023
024/**
025 * Interface representing HTTP cookie operations, supporting pojo-style getters and setters for all
026 * attributes which includes <a href="http://www.owasp.org/index.php/HttpOnly">HttpOnly</a> support.
027 * This allows Shiro to set <a href="http://www.owasp.org/index.php/HttpOnly">HttpOnly</a> cookies even on
028 * Servlet containers based on the {@code 2.4} and {@code 2.5} API (Servlet API 'native' support was only introduced in
029 * the {@code 2.6} specification).
030 *
031 * @since 1.0
032 */
033public interface Cookie {
034    /**
035     * The value of deleted cookie (with the maxAge 0).
036     */
037    String DELETED_COOKIE_VALUE = "deleteMe";
038
039
040    /**
041     * The number of seconds in one year (= 60 * 60 * 24 * 365).
042     */
043    int ONE_YEAR = 60 * 60 * 24 * 365;
044
045    /**
046     * Root path to use when the path hasn't been set and request context root is empty or null.
047     */
048    String ROOT_PATH = "/";
049
050    /**
051     * The SameSite attribute of the Set-Cookie HTTP response header allows you to declare
052     * if your cookie should be restricted to a first-party or same-site context.
053     */
054    enum SameSiteOptions {
055        /**
056         * Cookies will be sent in all contexts, i.e sending cross-origin is allowed.
057         *
058         * <p>None used to be the default value, but recent browser versions made Lax the default value
059         * to have reasonably robust defense against some classes of cross-site request forgery (CSRF) attacks.</p>
060         *
061         * <p>None requires the Secure attribute in latest browser versions. See below for more information.</p>
062         */
063        NONE,
064        /**
065         * Cookies are allowed to be sent with top-level navigations and will be sent along with GET requests
066         * initiated by third party website. This is the default value in modern browsers as of 2020.
067         */
068        LAX,
069        /**
070         * Cookies will only be sent in a first-party context
071         * and not be sent along with requests initiated by third party websites.
072         */
073        STRICT,
074    }
075
076    String getName();
077
078    void setName(String name);
079
080    String getValue();
081
082    void setValue(String value);
083
084    String getComment();
085
086    void setComment(String comment);
087
088    String getDomain();
089
090    void setDomain(String domain);
091
092    int getMaxAge();
093
094    void setMaxAge(int maxAge);
095
096    String getPath();
097
098    void setPath(String path);
099
100    boolean isSecure();
101
102    void setSecure(boolean secure);
103
104    int getVersion();
105
106    void setVersion(int version);
107
108    void setHttpOnly(boolean httpOnly);
109
110    boolean isHttpOnly();
111
112    void setSameSite(SameSiteOptions sameSite);
113
114    SameSiteOptions getSameSite();
115
116    void saveTo(HttpServletRequest request, HttpServletResponse response);
117
118    void removeFrom(HttpServletRequest request, HttpServletResponse response);
119
120    String readValue(HttpServletRequest request, HttpServletResponse response);
121}