Unsafe Cookie

import Foundation

class CookieManager {
    // VULNERABLE: Creating insecure cookie with Foundation
    func createUnsafeCookie() -> HTTPCookie? {
        // FLAW: Missing .secure (CWE-614) and .httpOnly  (CWE-1004) flags
        let properties: [HTTPCookiePropertyKey: Any] = [
            .name: "sessionId",
            .value: "abc123xyz",
            .domain: "example.com",
            .path: "/", // FLAW - too broad path
            .expires: Date().addingTimeInterval(86400), // FLAW: Persistent cookie (CWE-539)
        ]

        return HTTPCookie(properties: properties)
    }
}

import Vapor

class VaporCookieHandler {
    // VULNERABLE: Insecure cookie in Vapor
    func createUnsafeCookie_vulnerable3(req: Request) throws -> Response {
        let cookie = HTTPCookies.Value(
            name: "SESSIONID",   // FLAW: Sensitive name pattern
            value: "user_session_12345",
            expires: Date().addingTimeInterval(3600 * 24 * 7),  // FLAW: Persistent (CWE-539)
            domain: nil,         // Using default domain, ok
            path: "/",           // FLAW: Root path
            isSecure: false,     // FLAW: No Secure flag (CWE-614)
            isHTTPOnly: false,   // FLAW: No HttpOnly flag (CWE-1004)
            sameSite: nil        // Missing SameSite protection, but not enforced
        )

        var response = Response(status: .ok)
        response.cookies[cookie.name] = cookie
        return response
    }

    // VULNERABLE: Cookie with default insecure settings
    func createDefaultCookie_vulnerable4(req: Request) -> Response {
        var response = Response(status: .ok)

        // FLAW: Using minimal cookie configuration, defaults to insecure
        // values for path: "/", secure: false, httpOnly: false
        let cookie = HTTPCookies.Value(
            name: "userData",
            value: "sensitive_info"
        )

        response.cookies[cookie.name] = cookie
        return response
    }
}

import Foundation

class SecureCookieManager {
    // SECURE: Creating secure cookie with Foundation
    func createSecureCookie_secure1() -> HTTPCookie? {
        let properties: [HTTPCookiePropertyKey: Any] = [
            .name: "authToken",
            .value: "secure_token_value",
            .domain: "api.example.com",         // Specific domain
            .path: "/api/v1",                   // Specific path
            .secure: true,                      // SECURE: Only sent over HTTPS
            .init(rawValue: "HttpOnly"): true,  // SECURE: Not accessible to JavaScript
            // No .expires or .maximumAge = session cookie (non-persistent)
        ]

        return HTTPCookie(properties: properties)
    }

    // SECURE: Session cookie with SameSite protection
    func createSessionCookie_secure2() -> HTTPCookie? {
        let properties: [HTTPCookiePropertyKey: Any] = [
            .name: "session",
            .value: UUID().uuidString,
            .domain: "myapp.com",
            .path: "/",
            .secure: true,                          // HTTPS only
            .init(rawValue: "HttpOnly"): true,      // JavaScript cannot access
            .sameSitePolicy: "Strict",              // CSRF protection
            // Session cookie: no expiration
        ]

        return HTTPCookie(properties: properties)
    }
}

import Vapor

class SecureVaporCookieHandler {
    // SECURE: Properly configured secure cookie in Vapor
    func createSecureCookie_secure3(req: Request) throws -> Response {
        let cookie = HTTPCookies.Value(
            name: "sessionToken",
            value: generateSecureToken(),
            // No expires/maxAge = session cookie (non-persistent)
            domain: req.url.host,          // Specific to current host
            path: req.url.path,            // Specific path
            isSecure: true,                // SECURE: HTTPS only (CWE-614 fixed)
            isHTTPOnly: true,              // SECURE: XSS protection (CWE-1004 fixed)
            sameSite: .strict              // SECURE: CSRF protection
        )

        var response = Response(status: .ok)
        response.cookies[cookie.name] = cookie
        return response
    }

    // SECURE: Using Vapor's HTTPCookies builder with all security flags
    func createCookieViaBuilder_secure4(req: Request) -> Response {
        var response = Response(status: .ok)

        response.cookies["secure_session"] = HTTPCookies.Value(
            name: "secure_session",
            value: generateSecureToken(),
            isSecure: true,    // Only HTTPS
            isHTTPOnly: true,  // No script access
            sameSite: .lax     // Balance between security and usability
        )

        return response
    }

    private func generateSecureToken() -> String {
        // ... cryptographically secure random token generation
    }
}

extension HTTPCookie {
    /// Factory method to create secure session cookies
    static func secureSessionCookie(name: String, value: String, domain: String, path: String) -> HTTPCookie? {
        let properties: [HTTPCookiePropertyKey: Any] = [
            .name: name,
            .value: value,
            .domain: domain,
            .path: path,
            .secure: true,           // HTTPS only
            .setByJavaScript: true,  // No JavaScript access
            .sameSitePolicy: "Lax",  // some CSRF protection
            // No expiration = session cookie
        ]

        return HTTPCookie(properties: properties)
    }
}

// Usage
if let cookie = HTTPCookie.secureSessionCookie(
    name: "session",
    value: sessionId,
    domain: "api.example.com",
    path: "/api"
) {
    HTTPCookieStorage.shared.setCookie(cookie)
}

properties:
  checkPersistence: true
  invalidCookieNamePattern: '.*SESS(ION)?ID.*'
  invalidDomainPattern: '\.[^\.]+'
  invalidPathPattern: '/'
  enforceHttpOnly: true
  enforceSecure: true