first-party cookies are now same-site cookies

remove use of `:first_party` option

pass along provided value

make the syntax more flexible

s/strict/Strict/

3 files changed, 31 insertions, 8 deletions

diff --git a/HISTORY.md b/HISTORY.md
index f7795c5b..2d3a8e36 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,7 @@
+Tue Mar 15 15:18:44 2016 Ben Toews <mastahyeti@users.noreply.github.com>
+
+        * Backport support for the `SameSite` cookie attribute.
+
 Wed Jun 24 12:13:37 2015  Aaron Patterson <tenderlove@ruby-lang.org>
 
         * Fix Ruby 1.8 backwards compatibility
diff --git a/lib/rack/utils.rb b/lib/rack/utils.rb
index ab36ed84..328f6554 100644
--- a/lib/rack/utils.rb
+++ b/lib/rack/utils.rb
@@ -311,13 +311,20 @@ module Rack
           rfc2822(value[:expires].clone.gmtime) if value[:expires]
         secure = "; secure"  if value[:secure]
         httponly = "; HttpOnly" if (value.key?(:httponly) ? value[:httponly] : value[:http_only])
-        first_party = "; First-Party" if value[:first_party]
+        same_site = if value[:same_site]
+          case value[:same_site]
+          when Symbol, String
+            "; SameSite=#{value[:same_site]}"
+          else
+            "; SameSite"
+          end
+        end
         value = value[:value]
       end
       value = [value] unless Array === value
       cookie = escape(key) + "=" +
         value.map { |v| escape v }.join("&") +
-        "#{domain}#{path}#{max_age}#{expires}#{secure}#{httponly}#{first_party}"
+        "#{domain}#{path}#{max_age}#{expires}#{secure}#{httponly}#{same_site}"
 
       case header["Set-Cookie"]
       when nil, ''
diff --git a/test/spec_response.rb b/test/spec_response.rb
index c0354934..bca892d6 100644
--- a/test/spec_response.rb
+++ b/test/spec_response.rb
@@ -97,17 +97,29 @@ describe Rack::Response do
     response["Set-Cookie"].should.equal "foo=bar"
   end
 
-  it "can set First-Party cookies" do
+  it "can set SameSite cookies with any truthy value" do
     response = Rack::Response.new
-    response.set_cookie "foo", {:value => "bar", :first_party => true}
-    response["Set-Cookie"].must_equal "foo=bar; First-Party"
+    response.set_cookie "foo", {:value => "bar", :same_site => Object.new}
+    response["Set-Cookie"].should.equal "foo=bar; SameSite"
+  end
+
+  it "can set SameSite cookies with string value" do
+    response = Rack::Response.new
+    response.set_cookie "foo", {:value => "bar", :same_site => "Lax"}
+    response["Set-Cookie"].should.equal "foo=bar; SameSite=Lax"
+  end
+
+  it "can set SameSite cookies with symbol value" do
+    response = Rack::Response.new
+    response.set_cookie "foo", {:value => "bar", :same_site => :Strict}
+    response["Set-Cookie"].should.equal "foo=bar; SameSite=Strict"
   end
 
   [ nil, false ].each do |non_truthy|
-    it "omits First-Party attribute given a #{non_truthy.inspect} value" do
+    it "omits SameSite attribute given a #{non_truthy.inspect} value" do
       response = Rack::Response.new
-      response.set_cookie "foo", {:value => "bar", :first_party => non_truthy}
-      response["Set-Cookie"].must_equal "foo=bar"
+      response.set_cookie "foo", {:value => "bar", :same_site => non_truthy}
+      response["Set-Cookie"].should.equal "foo=bar"
     end
   end