Make the default HTTP server configuration more secure

tests/standalone/io/http_headers_test.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 library dart.io;
 
 import "package:expect/expect.dart";
 import "dart:async";
 import "dart:collection";
 import "dart:convert";
@@ skipping 348 matching lines @@
     }
 
     void checkCookie(cookie, s) {
       Expect.equals(s, cookie.toString());
       var c = new _Cookie.fromSetCookieValue(s);
       checkCookiesEquals(cookie, c);
     }
 
     Cookie cookie;
     cookie = new Cookie(name, value);
-    Expect.equals("$name=$value", cookie.toString());
+    Expect.equals("$name=$value; HttpOnly", cookie.toString());
     DateTime date = new DateTime.utc(2014, DateTime.JANUARY, 5, 23, 59, 59, 0);
     cookie.expires = date;
     checkCookie(cookie, "$name=$value"
-                "; Expires=Sun, 05 Jan 2014 23:59:59 GMT");
+                "; Expires=Sun, 05 Jan 2014 23:59:59 GMT"
+                "; HttpOnly");
     cookie.maxAge = 567;
     checkCookie(cookie, "$name=$value"
                 "; Expires=Sun, 05 Jan 2014 23:59:59 GMT"
-                "; Max-Age=567");
+                "; Max-Age=567"
+                "; HttpOnly");
     cookie.domain = "example.com";
     checkCookie(cookie, "$name=$value"
                 "; Expires=Sun, 05 Jan 2014 23:59:59 GMT"
                 "; Max-Age=567"
-                "; Domain=example.com");
+                "; Domain=example.com"
+                "; HttpOnly");
     cookie.path = "/xxx";
     checkCookie(cookie, "$name=$value"
                 "; Expires=Sun, 05 Jan 2014 23:59:59 GMT"
                 "; Max-Age=567"
                 "; Domain=example.com"
-                "; Path=/xxx");
+                "; Path=/xxx"
+                "; HttpOnly");
     cookie.secure = true;
     checkCookie(cookie, "$name=$value"
                 "; Expires=Sun, 05 Jan 2014 23:59:59 GMT"
                 "; Max-Age=567"
                 "; Domain=example.com"
                 "; Path=/xxx"
-                "; Secure");
-    cookie.httpOnly = true;
-    checkCookie(cookie, "$name=$value"
-                "; Expires=Sun, 05 Jan 2014 23:59:59 GMT"
-                "; Max-Age=567"
-                "; Domain=example.com"
-                "; Path=/xxx"
                 "; Secure"
                 "; HttpOnly");
+    cookie.httpOnly = false;
+    checkCookie(cookie, "$name=$value"
+                "; Expires=Sun, 05 Jan 2014 23:59:59 GMT"
+                "; Max-Age=567"
+                "; Domain=example.com"
+                "; Path=/xxx"
+                "; Secure");
     cookie.expires = null;
     checkCookie(cookie, "$name=$value"
                 "; Max-Age=567"
                 "; Domain=example.com"
                 "; Path=/xxx"
-                "; Secure"
-                "; HttpOnly");
+                "; Secure");
     cookie.maxAge = null;
     checkCookie(cookie, "$name=$value"
                 "; Domain=example.com"
                 "; Path=/xxx"
-                "; Secure"
-                "; HttpOnly");
+                "; Secure");
     cookie.domain = null;
     checkCookie(cookie, "$name=$value"
                 "; Path=/xxx"
-                "; Secure"
-                "; HttpOnly");
+                "; Secure");
     cookie.path = null;
     checkCookie(cookie, "$name=$value"
-                "; Secure"
-                "; HttpOnly");
+                "; Secure");
     cookie.secure = false;
-    checkCookie(cookie, "$name=$value"
-                "; HttpOnly");
-    cookie.httpOnly = false;
     checkCookie(cookie, "$name=$value");
   }
   test("name", "value");
   test("abc", "def");
   test("ABC", "DEF");
   test("Abc", "Def");
   test("SID", "sJdkjKSJD12343kjKj78");
 }
 
 void testInvalidCookie() {
@@ skipping 52 matching lines @@
                     (e) => e is FormatException);
     }
   }
   test('\r');
   test('\n');
   test('test\x00');
   // Test we handle other types correctly.
   test(new StringBuffer('\x00'), remove: false);
 }
 
+void testClear() {
+  _HttpHeaders headers = new _HttpHeaders("1.1");
+  headers.add("a", "b");
+  headers.contentLength = 7;
+  headers.chunkedTransferEncoding = true;
+  headers.clear();
+  Expect.isNull(headers["a"]);
+  Expect.equals(headers.contentLength, -1);
+  Expect.isFalse(headers.chunkedTransferEncoding);
+}
+
 main() {
   testMultiValue();
   testDate();
   testExpires();
   testIfModifiedSince();
   testHost();
   testEnumeration();
   testHeaderValue();
   testContentType();
   testContentTypeCache();
   testCookie();
   testInvalidCookie();
   testHeaderLists();
   testInvalidFieldName();
   testInvalidFieldValue();
+  testClear();
 }