arizona_cookie (arizona v0.4.0)

View Source

Set-Cookie serialization (RFC 6265 §4.1), independent of any HTTP server.

A response cookie is stashed on the arizona_req:request() by arizona_req:put_resp_cookie/4 and by the session and flash writers, and arizona_req:flush/1 serializes it here, so every server adapter emits the same bytes. arizona_session budgets the session_max_bytes cap against this exact format.

Summary

Functions

serialize(Name, Value, Opts)

Builds a Set-Cookie header value.

Functions

serialize(Name, Value, Opts)

-spec serialize(Name, Value, Opts) -> binary()
                   when Name :: binary(), Value :: binary(), Opts :: arizona_req:resp_cookie_opts().

Builds a Set-Cookie header value.

Attributes are appended in this fixed order: Domain, Path, Max-Age, Expires, Secure, HttpOnly, SameSite. The boolean flags appear only when true.

Every caller-supplied binary is checked against the RFC 6265 §4.1.1 grammar first, and a violation raises rather than reaching the wire, where a ; or a line break in a value echoed from user input would smuggle attributes or split the header:

  • {invalid_cookie_name, Bin} -- Name is empty or has a byte outside an RFC 9110 token
  • {invalid_cookie_value, Bin} -- Value has a byte outside cookie-octet (CTL, SP, DQUOTE, ,, ;, \\)
  • {invalid_cookie_attr, Attr, Bin} -- Domain, Path, or Expires holds a byte that would end the attribute or the line