// SecureCookie retrieves a secure cookie from a HTTP request
486336
func SecureCookie(req *http.Request, name string, cookieSecret string) (string, bool) {
	for _, cookie := range req.Cookies() {
		if cookie.Name != name {
			continue
		}

		parts := strings.SplitN(cookie.Value, "|", 3)

		// fix potential out of range error
		if len(parts) != 3 {
			return "", false
		}

		val := parts[0]
		timestamp := parts[1]
		signature := parts[2]

		if Signature(cookieSecret, []byte(val), timestamp) != signature {
			return "", false
		}

		ts, _ := strconv.ParseInt(timestamp, 0, 64)
		if time.Now().Unix()-31*86400 > ts {
			return "", false
		}

		buf := bytes.NewBufferString(val)
		encoder := base64.NewDecoder(base64.StdEncoding, buf)

		res, _ := ioutil.ReadAll(encoder)
		return string(res), true
	}
	return "", false
}
1014627
func SecureClient(c rpcclient.Client, cert *lite.DynamicVerifier) Wrapper {
	prt := defaultProofRuntime()
	wrap := Wrapper{c, cert, prt}
	// TODO: no longer possible as no more such interface exposed....
	// if we wrap http client, then we can swap out the event switch to filter
	// if hc, ok := c.(*rpcclient.HTTP); ok {
	// 	evt := hc.WSEvents.EventSwitch
	// 	hc.WSEvents.EventSwitch = WrappedSwitch{evt, wrap}
	// }
	return wrap
}
578799
func (r *Req) EnableCookie(enable bool) {
	if enable {
		jar, _ := cookiejar.New(nil)
		r.Client().Jar = jar
	} else {
		r.Client().Jar = nil
	}
}
558298
func (c *Context) SecureJSON(code int, obj interface{}) {
	c.Render(code, render.SecureJSON{Prefix: c.engine.secureJsonPrefix, Data: obj})
}
764756
func (s *HTTPScaffold) SecureAddress() string {
	if s.secureListener == nil {
		return ""
	}
	return s.secureListener.Addr().String()
}
342297
func (state *UserState) UsernameCookie(req *http.Request) (string, error) {
	username, ok := cookie.SecureCookie(req, "user", state.cookieSecret)
	if ok && (username != "") {
		return username, nil
	}
	return "", ErrCookieGetUsername

}
1221109
func (c *secureCookies) Uint64(key string) (uint64, error) {
	ck, err := c.req.Cookie(key)
	if err != nil {
		return 0, err
	}
	s := parseSecureCookie(c.secret, ck.Value)
	return strconv.ParseUint(s, 10, 64)
}
1009620
func (this *Request) Cookie(n string, i ...interface{}) string {

	cookie, err := this.Request.Cookie(n)

	if err != nil {
		return ""
	}

	/*
	   Unescape the cookie.
	*/
	var v string
	var e error
	v, e = url.QueryUnescape(cookie.Value)
	v, e = Decode(v)

	if e != nil {
		return ""
	}

	/*
	   If no interface was given then just return the Value.
	*/

	if len(i) == 0 {
		return v
	}

	json.Unmarshal([]byte(v), i[0])

	return v
}
1293787
func (sm *SSMuxer) SecureInbound(ctx context.Context, insecure net.Conn) (connsec.Conn, error) {
	tpt, err := sm.selectProto(ctx, insecure, true)
	if err != nil {
		return nil, err
	}
	return tpt.SecureInbound(ctx, insecure)
}
522517
func (b *HttpRequest) SetEnableCookie(enable bool) *HttpRequest {
	b.setting.EnableCookie = enable
	return b
}
894778
func makeSessionCookie(c context.Context, sid string, secure bool) (*http.Cookie, error) {
	tok, err := sessionCookieToken.Generate(c, nil, map[string]string{"sid": sid}, 0)
	if err != nil {
		return nil, err
	}
	// Make cookie expire a bit earlier, to avoid weird "bad token" errors if
	// clocks are out of sync.
	exp := sessionCookieToken.Expiration - 15*time.Minute
	return &http.Cookie{
		Name:     sessionCookieName,
		Value:    tok,
		Path:     "/",
		Secure:   secure,
		HttpOnly: true, // no access from Javascript
		Expires:  clock.Now(c).Add(exp),
		MaxAge:   int(exp / time.Second),
	}, nil
}
691568
func generateSecureAdminToken(secret string) (string, error) {
	s := securecookie.New([]byte(secret), nil)
	return s.Encode(secureAdminTokenKey, secureAdminTokenValue)
}
478410
func (ctx *context) RemoveCookie(name string, options ...CookieOption) {
	c := &http.Cookie{}
	c.Name = name
	c.Value = ""
	c.Path = "/" // if user wants to change it, use of the CookieOption `CookiePath` is required if not `ctx.SetCookie`.
	c.HttpOnly = true
	// RFC says 1 second, but let's do it 1  to make sure is working
	exp := time.Now().Add(-time.Duration(1) * time.Minute)
	c.Expires = exp
	c.MaxAge = -1
	ctx.SetCookie(c, options...)
	// delete request's cookie also, which is temporary available.
	ctx.request.Header.Set("Cookie", "")
}
1087296
func Secure(opts ...*SecureOpts) fibre.MiddlewareFunc {
	return func(h fibre.HandlerFunc) fibre.HandlerFunc {
		return func(c *fibre.Context) error {

			var config *SecureOpts

			switch len(opts) {
			case 0:
				config = defaultSecureOpts
			default:
				config = opts[0]
			}

			if config.RedirectHTTP && (!c.IsTLS() || c.Request().Header().Get(fibre.HeaderXForwardedProto) == "http") {
				h := c.Request().Host
				u := c.Request().RequestURI
				return c.Redirect(301, "https://"+h+u)
			}

			// This is a socket
			if c.IsSocket() {
				return h(c)
			}

			if config.XSSProtection != "" {
				c.Response().Header().Set(fibre.HeaderXXSSProtection, config.XSSProtection)
			}

			if config.FrameOptions != "" {
				c.Response().Header().Set(fibre.HeaderXFrameOptions, config.FrameOptions)
			}

			if config.ContentTypeOptions != "" {
				c.Response().Header().Set(fibre.HeaderXContentTypeOptions, config.ContentTypeOptions)
			}

			if config.ContentSecurityPolicy != "" {
				c.Response().Header().Set(fibre.HeaderContentSecurityPolicy, config.ContentSecurityPolicy)
			}

			if config.PublicKeyPins != "" {
				c.Response().Header().Set(fibre.HeaderPublicKeyPins, config.PublicKeyPins)
			}

			if (c.IsTLS() || c.Request().Header().Get(fibre.HeaderXForwardedProto) == "https") && config.HSTSMaxAge != 0 {
				if config.HSTSIncludeSubdomains {
					c.Response().Header().Set(fibre.HeaderStrictTransportSecurity, fmt.Sprintf("max-age=%d; includeSubdomains", config.HSTSMaxAge))
				} else {
					c.Response().Header().Set(fibre.HeaderStrictTransportSecurity, fmt.Sprintf("max-age=%d", config.HSTSMaxAge))
				}
			}

			return h(c)

		}
	}
}
991864
func (p *ProviderData) SessionFromCookie(v string, c *cookie.Cipher) (s *SessionState, err error) {
	return DecodeSessionState(v, c)
}
250177
func Decode(cookie *http.Cookie, secret string) string {
	return DecodeStr(cookie.Value, secret)
}
251927
func RemoveCookie(ctx context.Context, config Config) {
	cookie, err := ctx.Request().Cookie(config.Cookie)
	if err != nil {
		return
	}

	cookie.Expires = CookieExpireDelete
	// MaxAge<0 means delete cookie now, equivalently 'Max-Age: 0'
	cookie.MaxAge = -1
	cookie.Value = ""
	cookie.Path = "/"
	cookie.Domain = formatCookieDomain(ctx, config.DisableSubdomainPersistence)

	AddCookie(ctx, cookie, config.AllowReclaim)

	if config.AllowReclaim {
		// delete request's cookie also, which is temporary available.
		ctx.Request().Header.Set("Cookie", "")
	}
}