class Greed::Cookie::DomainHandler
Public Instance Methods
determine_domain(document_domain, cookie_domain)
click to toggle source
# File lib/greed/cookie/domain_handler.rb, line 16 def determine_domain(document_domain, cookie_domain) document_domain = document_domain.downcase unless cookie_domain.present? return { domain: document_domain, # cookie domain not present include_subdomains: false } end document_ip_address = begin ::IPAddr.new(document_domain) rescue ::IPAddr::Error nil end if document_ip_address # handles IP Addresses cookie_ip_address = begin ::IPAddr.new(cookie_domain) rescue ::IPAddr::Error raise CrossDomainViolation end raise CrossDomainViolation unless cookie_ip_address == document_ip_address return { domain: cookie_ip_address.to_s, # normalized include_subdomains: false } end cookie_domain = cookie_domain.downcase # ignore leading dot matched_data = /\A\s*\.?(?!\.)(\S+)\s*\z/.match(cookie_domain) raise MalformedCookieDomain unless matched_data cookie_domain = matched_data[1] if document_domain == cookie_domain # exact domain matched return { domain: document_domain, include_subdomains: true } end # prevent setting cookie on a top level domain # "localhost" use cases should already ruled out with the exact domain match condition raise CrossDomainViolation unless ::PublicSuffix.valid?(cookie_domain, ignore_private: true) # prevent parent domain from setting cookie of a subdomain raise CrossDomainViolation unless (document_domain[ document_domain.size - cookie_domain.size, cookie_domain.size ] == cookie_domain) && \ (document_domain[ document_domain.size - cookie_domain.size - 1 ] == ?.) { domain: cookie_domain, # set cookie for its parent domain include_subdomains: true } end