Checking in changes prior to tagging of version 0.26. Changelog diff is:

[catagits/Catalyst-Plugin-Session.git] / lib / Catalyst / Plugin / Session.pm

diff --git a/lib/Catalyst/Plugin/Session.pm b/lib/Catalyst/Plugin/Session.pm
index 7290266..31d7833 100644 (file)
--- a/lib/Catalyst/Plugin/Session.pm
+++ b/lib/Catalyst/Plugin/Session.pm
@@ -13,7 +13,7 @@ use Carp;
 
 use namespace::clean -except => 'meta';
 
-our $VERSION = '0.23';
+our $VERSION = '0.26';
 
 my @session_data_accessors; # used in delete_session
 
@@ -80,14 +80,14 @@ sub setup_session {
 sub prepare_action {
     my $c = shift;
 
+    $c->maybe::next::method(@_);
+
     if (    $c->config->{session}{flash_to_stash}
         and $c->sessionid
         and my $flash_data = $c->flash )
     {
         @{ $c->stash }{ keys %$flash_data } = values %$flash_data;
     }
-
-    $c->maybe::next::method(@_);
 }
 
 sub finalize_headers {
@@ -168,7 +168,7 @@ sub _save_flash {
                 delete $flash_data->{$key};
             }
         }
-        
+
         my $sid = $c->sessionid;
 
         my $session_data = $c->_session;
@@ -262,7 +262,7 @@ sub _load_flash {
         if ( my $flash_data = $c->_flash )
         {
             $c->_flash_key_hashes({ map { $_ => Object::Signature::signature( \$flash_data->{$_} ) } keys %$flash_data });
-            
+
             return $flash_data;
         }
     }
@@ -288,6 +288,24 @@ sub _clear_session_instance_data {
     $c->maybe::next::method(@_); # allow other plugins to hook in on this
 }
 
+sub change_session_id {
+    my $c = shift;
+
+    my $sessiondata = $c->session;
+    my $oldsid = $c->sessionid;
+    my $newsid = $c->create_session_id;
+
+    if ($oldsid) {
+        $c->log->debug(qq/change_sessid: deleting session data from "$oldsid"/) if $c->debug;
+        $c->delete_session_data("${_}:${oldsid}") for qw/session expires flash/;
+    }
+
+    $c->log->debug(qq/change_sessid: storing session data to "$newsid"/) if $c->debug;
+    $c->store_session_data( "session:$newsid" => $sessiondata );
+
+    return $newsid;
+}
+
 sub delete_session {
     my ( $c, $msg ) = @_;
 
@@ -345,7 +363,7 @@ sub calculate_extended_session_expires {
 
 sub reset_session_expires {
     my ( $c, $sid ) = @_;
-    
+
     my $exp = $c->calculate_initial_session_expires;
     $c->_session_expires( $exp );
     $c->_extended_session_expires( $exp );
@@ -354,7 +372,7 @@ sub reset_session_expires {
 
 sub sessionid {
     my $c = shift;
-    
+
     return $c->_sessionid || $c->_load_sessionid;
 }
 
@@ -410,7 +428,7 @@ sub keep_flash {
     (@{$href}{@keys}) = ((undef) x @keys);
 }
 
-sub _flash_data { 
+sub _flash_data {
     my $c = shift;
     $c->_flash || $c->_load_flash || do {
         $c->create_session_id_if_needed;
@@ -436,7 +454,7 @@ sub flash {
 
 sub clear_flash {
     my $c = shift;
-    
+
     #$c->delete_session_data("flash:" . $c->sessionid); # should this be in here? or delayed till finalization?
     $c->_flash_key_hashes({});
     $c->_flash_keep_keys({});
@@ -463,12 +481,12 @@ sub initialize_session_data {
 
             (
                 $c->config->{session}{verify_address}
-                ? ( __address => $c->request->address )
+                ? ( __address => $c->request->address||'' )
                 : ()
             ),
             (
                 $c->config->{session}{verify_user_agent}
-                ? ( __user_agent => $c->request->user_agent )
+                ? ( __user_agent => $c->request->user_agent||'' )
                 : ()
             ),
         }
@@ -490,7 +508,7 @@ sub create_session_id_if_needed {
 
 sub create_session_id {
     my $c = shift;
-    
+
     my $sid = $c->generate_session_id;
 
     $c->log->debug(qq/Created session "$sid"/) if $c->debug;
@@ -694,7 +712,7 @@ of every request.
         my ( $self, $c ) = @_;
 
         if ( exists $c->flash->{beans} ) { # false
-        
+
         }
     }
 
@@ -749,6 +767,31 @@ an hour.
 
 Note that these values are not auto extended.
 
+=item change_session_id
+
+By calling this method you can force a session id change while keeping all
+session data. This method might come handy when you are paranoid about some
+advanced variations of session fixation attack.
+
+If you want to prevent this session fixation scenario:
+
+    0) let us have WebApp with anonymous and authenticated parts
+    1) a hacker goes to vulnerable WebApp and gets a real sessionid,
+       just by browsing anonymous part of WebApp
+    2) the hacker inserts (somehow) this values into a cookie in victim's browser
+    3) after the victim logs into WebApp the hacker can enter his/her session
+
+you should call change_session_id in your login controller like this:
+
+      if ($c->authenticate( { username => $user, password => $pass } )) {
+        # login OK
+        $c->change_session_id;
+        ...
+      } else {
+        # login FAILED
+        ...
+      }
+
 =back
 
 =head1 INTERNAL METHODS
@@ -935,7 +978,7 @@ Defaults to false.
 =item verify_user_agent
 
 When true, C<<$c->request->user_agent>> will be checked at prepare time. If it
-is not the same as the user agent that initiated the session, the session is 
+is not the same as the user agent that initiated the session, the session is
 deleted.
 
 Defaults to false.
@@ -1050,6 +1093,8 @@ Tomas Doran (t0m) C<bobtfish@bobtfish.net> (current maintainer)
 
 Sergio Salvi
 
+kmx C<kmx@volny.cz>
+
 And countless other contributers from #catalyst. Thanks guys!
 
 =head1 COPYRIGHT & LICENSE