Origin 检查、cookie 与 session

// Only a request that can do damage needs verification: any
// method beyond the safe ones, and a WebSocket handshake, which
// arrives as a GET but opens a credentialed two-way connection.
let upgrades_to_websocket = header(header::UPGRADE.as_str())
    .is_some_and(|value| value.trim().eq_ignore_ascii_case("websocket"));
if !upgrades_to_websocket
    && matches!(method(cx), &Method::GET | &Method::HEAD | &Method::OPTIONS)
{
    return OriginVerdict::Allow;
}
// ...
// The "sec-fetch-site" header is the browser's way to declare that the request
// comes from the same origin. If so, it is safe.
if let Some(site) = header("sec-fetch-site") {
    return if matches!(site, "same-origin" | "none") {
        OriginVerdict::Allow
    } else {
        OriginVerdict::Deny
    };
}

no headers (curl)                                            200
Origin same (http://127.0.0.1:38206)                         200
Origin http://evil.example                                   403
Origin https://127.0.0.1:38206 (scheme differs)              200
Sec-Fetch-Site: same-origin                                  200
Sec-Fetch-Site: same-site                                    403
Sec-Fetch-Site: cross-site                                   403
Sec-Fetch-Site: none                                         200
Sec-Fetch-Site: same-origin + Origin evil                    200
GET cross-site (/me)                                         200
POST cross-site to unknown path /nope                        403
Origin accounts.example.com (default policy)                 403
POST /hook cross-site (default policy)                       403
-- loose policy
Origin accounts.example.com + cross-site                     200
Origin ACCOUNTS.example.com (case)                           200
POST /hook cross-site                                        200
POST /submit cross-site evil                                 403

fn handle<'a>(&'a self, cx: &'a Cx, body: Body, next: Next<'a>) -> LayerFuture<'a> {
    Box::pin(async move {
        let cx = cx.with(CookieJarCell::new());

        match next.run(&cx, body).await {
            Ok(mut response) => {
                write_cookies(&cx, response.headers_mut());
                Ok(response)
            }
            // The error's response does not exist yet, so the cookies
            // wait in the router's slot and land on it once it is built.
            Err(error) => {
                let mut headers = HeaderMap::new();
                write_cookies(&cx, &mut headers);
                response_headers(&cx).extend(headers);
                Err(error)
            }
        }
    })
}

HTTP/1.1 401 Unauthorized
content-type: text/plain; charset=utf-8
set-cookie: flash=denied
content-length: 12

#[component]
async fn late_writer(cx: &Cx) -> Result<impl View> {
  tokio::time::sleep(Duration::from_millis(100)).await;
  cookies(cx).add(("late", "1"));
  Ok(view! { <p>"late"</p> })
}
// 页面：<h1>"Late"</h1> suspense(fallback: view! { <p>"loading"</p> }, late_writer())

[   0ms] HTTP/1.1 200 OK
...
transfer-encoding: chunked

9B
<h1>Late</h1><!--::topcoat::region::start(a0a5e7b6...)--><p>loading</p><!--::topcoat::region::end(a0a5e7b6...)-->

[ 106ms] <EOF>

cannot add a cookie after the response headers have been sent. Pending cookies are written when the handler returns, so work that outlives it, such as a streaming body or a WebSocket task, can only read cookies

jar.add(cookie!("theme" = "dark"; Path = "/"));
signed_cookies(cx).add(cookie!("uid" = "42"; Path = "/"));
private_cookies(cx).add(cookie!("secret" = "s3cr3t"; Path = "/"));

set-cookie: theme=dark; Path=/
set-cookie: uid=cShJmJKKuQBJ1BTNldZa%2FmH+YqJDNrQpZpjG3+ykWBU%3D42; Path=/
set-cookie: secret=2J1rsqpPk55KjF9LM+WNOCDWkdc7K7flZzYk5wdSXAKANw%3D%3D; Path=/

theme=Some("dark") signed=None private=None

pub async fn start(cx: &Cx) -> Result<Session> {
    let token = Token::random();
    let session = Session {
        token_hash: token.hash(),
        expires_at: expires_at(cx),
    };
    token_store(cx)
        .write(cx, token.clone(), config(cx).lifetime)
        .await?;
    state(cx).set(Some(token)).await;
    Ok(session)
}

fn cookies(cx: &Cx) -> impl Cookies {
    topcoat_cookie::cookies(cx)
        .override_same_site(SameSite::Lax)
        .override_http_only(true)
        .override_secure(true)
        .override_path("/")
        .override_prefix_host()
}

== login
HTTP/1.1 303 See Other
location: /me
set-cookie: __Host-session=460hWb8ykpaW45jFkrFgbJ7CWKKfrHzKpcIx5Bf1vjs%3D; HttpOnly; SameSite=Lax; Secure; Path=/; Max-Age=2592000

== rotate
set-cookie: __Host-session=03UFRQPFJjy7lgc3hiO_LmepzWk7Mi73QuplYF5OKpE%3D; HttpOnly; SameSite=Lax; Secure; Path=/; Max-Age=2592000
Some(Rotation { revoked: TokenHash([112, 40, 53, ...]), session: Session { ... } })

== logout
set-cookie: __Host-session=; HttpOnly; SameSite=Lax; Secure; Path=/; Max-Age=0; Expires=Fri, 31 Oct 2025 14:05:42 GMT

login status=0 type=opaqueredirect
me=session hash TokenHash([142, 215, 63, ...])
document.cookie=""
isSecureContext=true