use Object::Signature ();
use Carp;
-our $VERSION = "0.14";
+our $VERSION = '0.20';
my @session_data_accessors; # used in delete_session
BEGIN {
$c->NEXT::prepare_action(@_);
}
+sub finalize_headers {
+ my $c = shift;
+
+ # fix cookie before we send headers
+ $c->_save_session_expires;
+
+ return $c->NEXT::finalize_headers(@_);
+}
+
sub finalize {
my $c = shift;
+ my $ret = $c->NEXT::finalize(@_);
+ # then finish the rest
$c->finalize_session;
-
- $c->NEXT::finalize(@_);
+ return $ret;
}
sub finalize_session {
$c->_save_session_id;
$c->_save_session;
$c->_save_flash;
- $c->_save_session_expires;
$c->_clear_session_instance_data;
}
my $sid = $c->sessionid;
+ my $session_data = $c->_session;
if (%$flash_data) {
- $c->store_session_data( "flash:$sid", $flash_data );
+ $session_data->{__flash} = $flash_data;
}
else {
- $c->delete_session_data("flash:$sid");
+ delete $session_data->{__flash};
}
+ $c->_session($session_data);
+ $c->_save_session;
}
}
$c->_tried_loading_flash_data(1);
if ( my $sid = $c->sessionid ) {
- if ( my $flash_data = $c->_flash
- || $c->_flash( $c->get_session_data("flash:$sid") ) )
+
+ my $session_data = $c->session;
+ $c->_flash($session_data->{__flash});
+
+ if ( my $flash_data = $c->_flash )
{
$c->_flash_key_hashes({ map { $_ => Object::Signature::signature( \$flash_data->{$_} ) } keys %$flash_data });
sub flash {
my $c = shift;
$c->_flash_data;
- $c->_set_flash(@_);
- return $c->_flash;
+ $c->_set_flash(@_);
+ return $c->_flash;
}
sub clear_flash {
=head1 NAME
-Catalyst::Plugin::Session - Generic Session plugin - ties together server side
-storage and client side state required to maintain session data.
+Catalyst::Plugin::Session - Generic Session plugin - ties together server side storage and client side state required to maintain session data.
=head1 SYNOPSIS
Session::State::Cookie
/;
- # you can replace Store::FastMmap with Store::File - both have sensible
- # default configurations (see their docs for details)
+ # you can replace Store::FastMmap with Store::File - both have sensible
+ # default configurations (see their docs for details)
- # more complicated backends are available for other scenarios (DBI storage,
- # etc)
+ # more complicated backends are available for other scenarios (DBI storage,
+ # etc)
# after you've loaded the plugins you can save session data
=item keep_flash @keys
-If you wawnt to keep a flash key for the next request too, even if it hasn't
+If you want to keep a flash key for the next request too, even if it hasn't
changed, call C<keep_flash> and pass in the keys as arguments.
=item delete_session REASON
This method is used to invalidate a session. It takes an optional parameter
which will be saved in C<session_delete_reason> if provided.
+NOTE: This method will B<also> delete your flash data.
+
=item session_delete_reason
This accessor contains a string with the reason a session was deleted. Possible
=item prepare_action
-This methoid is extended.
+This method is extended.
-It's only effect is if the (off by default) C<flash_to_stash> configuration
+Its only effect is if the (off by default) C<flash_to_stash> configuration
parameter is on - then it will copy the contents of the flash to the stash at
prepare time.
+=item finalize_headers
+
+This method is extended and will extend the expiry time before sending
+the response.
+
=item finalize
-This method is extended and will extend the expiry time, as well as persist the
-session data if a session exists.
+This method is extended and will call finalize_session after the other
+finalizes run. Here we persist the session data if a session exists.
=item initialize_session_data
=item create_session_id
-Creates a new session id using C<generate_session_id> if there is no session ID
+Creates a new session ID using C<generate_session_id> if there is no session ID
yet.
=item validate_session_id SID
This method will return a string that can be used as a session ID. It is
supposed to be a reasonably random string with enough bits to prevent
collision. It basically takes C<session_hash_seed> and hashes it using SHA-1,
-MD5 or SHA-256, depending on the availibility of these modules.
+MD5 or SHA-256, depending on the availability of these modules.
=item session_hash_seed
=over 4
-=item *
-
-A counter
+=item * A counter
-=item *
-
-The current time
+=item * The current time
-=item *
+=item * One value from C<rand>.
-One value from C<rand>.
-
-=item *
+=item * The stringified value of a newly allocated hash reference
-The stringified value of a newly allocated hash reference
-
-=item *
-
-The stringified value of the Catalyst context object
+=item * The stringified value of the Catalyst context object
=back
-In the hopes that those combined values are entropic enough for most uses. If
+in the hopes that those combined values are entropic enough for most uses. If
this is not the case you can replace C<session_hash_seed> with e.g.
sub session_hash_seed {
See L<Catalyst/dump_these> - ammends the session data structure to the list of
dumped objects if session ID is defined.
+
+=item calculate_extended_session_expires
+
+=item calculate_initial_session_expires
+
+=item create_session_id_if_needed
+
+=item delete_session_id
+
+=item extend_session_expires
+
+=item extend_session_id
+
+=item get_session_id
+
+=item reset_session_expires
+
+=item session_is_valid
+
+=item set_session_id
+
=back
=head1 USING SESSIONS DURING PREPARE
C<prepare_action> L<Catalyst::Plugin::Session> will actually load the data from
the store.
- sub prepare_action {
- my $c = shift;
+ sub prepare_action {
+ my $c = shift;
- # don't touch $c->session yet!
+ # don't touch $c->session yet!
- $c->NEXT::prepare_action( @_ );
+ $c->NEXT::prepare_action( @_ );
- $c->session; # this is OK
- $c->sessionid; # this is also OK
- }
+ $c->session; # this is OK
+ $c->sessionid; # this is also OK
+ }
=head1 CONFIGURATION
To let these users access your site you can either disable address verification
as a whole, or provide a checkbox in the login dialog that tells the server
that it's OK for the address of the client to change. When the server sees that
-this box is checked it should delete the C<__address> sepcial key from the
+this box is checked it should delete the C<__address> special key from the
session hash when the hash is first created.
=head2 Race Conditions
-In this day and age where cleaning detergents and dutch football (not the
-american kind) teams roam the plains in great numbers, requests may happen
+In this day and age where cleaning detergents and Dutch football (not the
+American kind) teams roam the plains in great numbers, requests may happen
simultaneously. This means that there is some risk of session data being
overwritten, like this:
=item 1.
-request a starts, request b starts, with the same session id
+request a starts, request b starts, with the same session ID
=item 2.
=back
-If this is a concern in your application, a soon to be developed locking
+If this is a concern in your application, a soon-to-be-developed locking
solution is the only safe way to go. This will have a bigger overhead.
For applications where any given user is only making one request at a time this
=head1 AUTHORS
-=over 4
-
-=item Andy Grundman
+Andy Grundman
-=item Christian Hansen
+Christian Hansen
-=item Yuval Kogman, C<nothingmuch@woobling.org> (current maintainer)
+Yuval Kogman, C<nothingmuch@woobling.org> (current maintainer)
-=item Sebastian Riedel
-
-=back
+Sebastian Riedel
And countless other contributers from #catalyst. Thanks guys!
=head1 COPYRIGHT & LICENSE
- Copyright (c) 2005 the aforementioned authors. All rights
- reserved. This program is free software; you can redistribute
- it and/or modify it under the same terms as Perl itself.
+ Copyright (c) 2005 the aforementioned authors. All rights
+ reserved. This program is free software; you can redistribute
+ it and/or modify it under the same terms as Perl itself.
=cut