🥮 mooncakes.io

    moonbitstack/moonhttp/cookie does not have a README file

    pub(all) struct Cookie {
      name : String
      value : String
      expires : 
    Moment    ?
      max_age : Int?
      domain : String?
      path : String?
      secure : Bool
      http_only : Bool
      same_site : SameSite?
    } derive(Eq, 
    Debug    )

    One cookie, as Set-Cookie states it.

    An attribute left None is left out of the header, and means what leaving it out means: no Expires and no Max-Age is a session cookie, no Domain is the origin host alone, no Path is the request's own directory.

    Cookie::decode

    source
    fn Cookie::decode(raw : StringView) -> Cookie?

    The cookie a Set-Cookie field value states, or None when it states none — an empty field, or one whose first pair has no =.

    Everything §5.2 says to ignore is ignored rather than refused: an attribute no revision defines, an Expires that is not a date, a Max-Age that is not a number. A server sends what it sends, and a client that refused the header would lose the cookie over an attribute it does not even use.

    Cookie::encode

    source
    fn Cookie::encode(self : Cookie) -> String

    The Set-Cookie field value this cookie is sent as.

    Attributes come in RFC 6265 §4.1.1's order, which is the order a browser and a log reader expect. The octets a name, value, domain or path may not carry are dropped rather than escaped: what a reader gets back is then the text that was set, and a \r\n smuggled into a value cannot open a header of its own.

    An expires that is a time with no date aborts: a cookie cannot die at a clock reading, and a caller that built one has made a mistake rather than met a condition.

    Cookie::equal

    source
    fn Cookie::equal(Cookie, Cookie) -> Bool

    Cookie::new

    source
    fn Cookie::new(name : String, value : String, expires? : 
    Moment    , max_age? : Int, domain? : String, path? : String?, secure? : Bool, http_only? : Bool, same_site? : SameSite?) -> Cookie

    A cookie by name, with the defaults a server usually wants.

    path defaults to /, so the cookie covers the whole site, and same_site to Lax, which is what a browser assumes of a cookie that does not say — and what stops a cross-site form post from carrying a session. Passing None for either leaves the attribute out.

    Cookie::not_equal

    source
    fn Cookie::not_equal(x : Cookie, y : Cookie) -> Bool

    Cookie::to_repr

    source

    SameSite

    source
    pub(all) enum SameSite {
      Strict
      Lax
      Unrestricted
    } derive(Eq, 
    Debug    )

    How far a cross-site request may carry a cookie.

    Strict sends it only on a same-site request, Lax also on a top-level navigation, and Unrestricted sends it everywhere. Unrestricted is the wire value None, spelled differently here because None is the empty option; a browser honours it only on a Secure cookie.

    SameSite::code

    source
    fn SameSite::code(self : SameSite) -> String

    The attribute's wire spelling.

    SameSite::equal

    source
    fn SameSite::equal(SameSite, SameSite) -> Bool

    SameSite::not_equal

    source
    fn SameSite::not_equal(x : SameSite, y : SameSite) -> Bool

    SameSite::of

    source
    fn SameSite::of(text : StringView) -> SameSite?

    The attribute a spelling names, or None for one no revision defines.

    The comparison ignores case, as §5.2 says to do with every attribute value.

    SameSite::to_repr

    source

    decode

    source
    fn decode(raw : StringView) -> Array[(String, String)]

    The pairs a Cookie field value carries, in the order they arrived.

    A piece with no = is dropped rather than read as a name with no value, which is what §5.4 leaves a server free to do and what every server does. Duplicate names are kept: which one wins is the reader's decision, and [get] makes the one browsers make.

    encode

    source
    fn encode(items : ArrayView[(String, String)]) -> String

    The Cookie field value that sends these pairs, which is what a client writes back from what it was set.

    The header carries names and values and no attributes at all: those were the server's instructions to the client, not something the client repeats.

    get

    source
    fn get(raw : StringView, name : StringView) -> String?

    The value of the cookie named name in a Cookie field value, or None.

    The first of a repeated name wins, which is the value a browser sends first and the one every server library reads.

    Source Files