SignedCookie.php

<?
/*
Copyright (c) 2010 Austin Robert Bales

Permission is hereby granted, free of charge, to any person
obtaining a copy of this software and associated documentation
files (the "Software"), to deal in the Software without
restriction, including without limitation the rights to use,
copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following
conditions:

The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
OTHER DEALINGS IN THE SOFTWARE. */

/**
 * Some convenience functions for reading/writing signed cookies. 
 * Likely *requires* PHP 5.3. 
 *
 * @author Austin Bales
 */
class SignedCookie {

	/**
	 * The standard salt.
	 *
	 * @author Austin Bales
	 */
  private static $salt = "";
  
  /**
   * Call this method to set the standard salt for the cookies. Required if no salt will
   * be specified at runtime.
   *
   * @param string $salt 
   * @return void
   * @author Austin Bales
   */
  public static function setup($salt){
    self::$salt = $salt;
  }
  
  /**
   * Sets a SignedCookie. 
   *
   * @param string $name The name of the cookie you want to write.
   * @param array $public_session_data The data you want to store. 
   * @param string $salt (optional) A salt to override the SignedCookie default salt. Required if you have not set a default salt. 
   * @return void
   * @author Austin Bales
   */
  public static function set($name, array $public_session_data, $salt = ""){
    $serialized_public_session = serialize($public_session);

    if ($salt == "" && self::$salt == ""){
      throw new Exception("The cookie could not be written because no salt was provided.");
    }elseif($salt == "") {
      $salt = self::$salt;
    }

    $public_session_data['hash'] = sha1($serialized_public_session + $salt);
    setcookie($name, serialize($public_session_data));
  } 
  
  /**
   * Reads a signed cookie. 
   *
   * @param string $name 
   * @return false|array Unverified cookie data.
   * @author Austin Bales
   */
  public static function read($name){
    if (!isset($_COOKIE[$name])){
      return false;
    }
    return unserialize($_COOKIE[$name]);
  }
  
  /**
   * Verifies cookie data
   *
   * @param array $cookie_contents Containing at a 'hash' and one or more other values.
   * @param string $salt (optional) A salt to overide the default, if specified. Required if a default salt is not specified. 
   * @return false|array Verified cookie contents, sans the hash. Or false.
   * @author Austin Bales
   */       
  public static function verify(array $cookie_contents, $salt = ""){
    if ($salt == "" && self::$salt == ""){
      throw new Exception("The cookie could not be read because no salt was provided.");
    }elseif($salt == "") {
      $salt = self::$salt;
    }                     
   
    $hash_from_cookie = $cookie_contents['hash'];
    unset($cookie_contents['hash']); 

    if ($hash_from_cookie == (sha1($cookie_contents + self::$salt))){
      return $cookie_contents;
    } else {
      return false;
    }  
    
  } 
  /**
   * Reads and then verifies a SignedCookie by name.
   *
   * @param string $name The name of the cookie 
   * @return false|array Verified cookie contents, sans the hash. Or false.
   * @author Austin Bales
   */
  public static function read_and_verify($name){
      return verify(self::read($name));
  }               
}

//
//
// Examples
//
//
                                           
SignedCookie::setup("a_long_randomly_generated_salt_or_cool_password"); 

SignedCookie::set('visually_session', array(
  'user_id'=>1,
  'first_name'=>'Austin'
)); // or whatever

$cookie_data = SignedCookie::read("visually_session");  // Data or false

echo $cookie_data["user_id"]; // 1. 

// Link it into your ORM
//$user = User::get($cookie_data['user_id']);