use overload ();
use Object::Signature ();
use Carp;
+use List::Util qw/ max /;
use namespace::clean -except => 'meta';
-our $VERSION = '0.35';
+our $VERSION = '0.39';
$VERSION = eval $VERSION;
my @session_data_accessors; # used in delete_session
_tried_loading_session_data
_tried_loading_session_expires
_tried_loading_flash_data
+ _needs_early_session_finalization
/
);
expires => 7200,
verify_address => 0,
verify_user_agent => 0,
+ expiry_threshold => 0,
%$cfg,
);
sub finalize_headers {
my $c = shift;
- # Force extension of session_expires before finalizing headers, so a possible cookie will be
- # up to date. First call to session_expires will extend the expiry, subsequent calls will
+ # fix cookie before we send headers
+ $c->_save_session_expires;
+
+ # Force extension of session_expires before finalizing headers, so a pos
+ # up to date. First call to session_expires will extend the expiry, subs
# just return the previously extended value.
$c->session_expires;
+ $c->finalize_session if $c->_needs_early_session_finalization;
return $c->maybe::next::method(@_);
}
# We have to finalize our session *before* $c->engine->finalize_xxx is called,
# because we do not want to send the HTTP response before the session is stored/committed to
# the session database (or whatever Session::Store you use).
- $c->finalize_session;
+ $c->finalize_session unless $c->_needs_early_session_finalization;
+ $c->_clear_session_instance_data;
return $c->maybe::next::method(@_);
}
$c->maybe::next::method(@_);
- $c->_save_session_expires;
$c->_save_session_id;
$c->_save_session;
$c->_save_flash;
- $c->_clear_session_instance_data;
+}
+
+sub _session_updated {
+ my $c = shift;
+
+ if ( my $session_data = $c->_session ) {
+
+ no warnings 'uninitialized';
+ if ( Object::Signature::signature($session_data) ne
+ $c->_session_data_sig )
+ {
+ return $session_data;
+ } else {
+ return;
+ }
+
+ } else {
+
+ return;
+
+ }
}
sub _save_session_id {
my $c = shift;
if ( defined($c->_session_expires) ) {
- my $expires = $c->session_expires; # force extension
- my $sid = $c->sessionid;
- $c->store_session_data( "expires:$sid" => $expires );
+ if (my $sid = $c->sessionid) {
+
+ my $current = $c->_get_stored_session_expires;
+ my $extended = $c->session_expires;
+ if ($extended > $current) {
+ $c->store_session_data( "expires:$sid" => $extended );
+ }
+
+ }
}
}
sub _save_session {
my $c = shift;
- if ( my $session_data = $c->_session ) {
+ if ( my $session_data = $c->_session_updated ) {
- no warnings 'uninitialized';
- if ( Object::Signature::signature($session_data) ne
- $c->_session_data_sig )
- {
- $session_data->{__updated} = time();
- my $sid = $c->sessionid;
- $c->store_session_data( "session:$sid" => $session_data );
- }
+ $session_data->{__updated} = time();
+ my $sid = $c->sessionid;
+ $c->store_session_data( "session:$sid" => $session_data );
}
}
$c->_tried_loading_session_expires(1);
if ( my $sid = $c->sessionid ) {
- my $expires = $c->get_session_data("expires:$sid") || 0;
+ my $expires = $c->_get_stored_session_expires;
if ( $expires >= time() ) {
$c->_session_expires( $expires );
sub extend_session_expires {
my ( $c, $expires ) = @_;
- $c->_extended_session_expires( my $updated = $c->calculate_initial_session_expires( $expires ) );
- $c->extend_session_id( $c->sessionid, $updated );
- return $updated;
+
+ my $threshold = $c->_session_plugin_config->{expiry_threshold} || 0;
+
+ if ( my $sid = $c->sessionid ) {
+ my $expires = $c->_get_stored_session_expires;
+ my $cutoff = $expires - $threshold;
+
+ if (!$threshold || $cutoff <= time || $c->_session_updated) {
+
+ $c->_extended_session_expires( my $updated = $c->calculate_initial_session_expires() );
+ $c->extend_session_id( $sid, $updated );
+
+ return $updated;
+
+ } else {
+
+ return $expires;
+
+ }
+
+ } else {
+
+ return;
+
+ }
+
}
sub change_session_expires {
$c->store_session_data( "expires:$sid" => $time_exp );
}
+sub _get_stored_session_expires {
+ my ($c) = @_;
+
+ if ( my $sid = $c->sessionid ) {
+ return $c->get_session_data("expires:$sid") || 0;
+ } else {
+ return 0;
+ }
+}
+
sub initial_session_expires {
my $c = shift;
return ( time() + $c->_session_plugin_config->{expires} );
}
sub calculate_initial_session_expires {
- my $c = shift;
-
- my $initial_expires = $c->initial_session_expires;
- my $stored_session_expires = 0;
- if ( my $sid = $c->sessionid ) {
- $stored_session_expires = $c->get_session_data("expires:$sid") || 0;
- }
- return ( $initial_expires > $stored_session_expires ) ? $initial_expires : $stored_session_expires;
+ my ($c) = @_;
+ return max( $c->initial_session_expires, $c->_get_stored_session_expires );
}
sub calculate_extended_session_expires {
The time-to-live of each session, expressed in seconds. Defaults to 7200 (two
hours).
+=item expiry_threshold
+
+Only update the session expiry time if it would otherwise expire
+within this many seconds from now.
+
+The purpose of this is to keep the session store from being updated
+when nothing else in the session is updated.
+
+Defaults to 0 (in which case, the expiration will always be updated).
+
=item verify_address
-When true, C<<$c->request->address>> will be checked at prepare time. If it is
+When true, C<< $c->request->address >> will be checked at prepare time. If it is
not the same as the address that initiated the session, the session is deleted.
Defaults to false.
=item verify_user_agent
-When true, C<<$c->request->user_agent>> will be checked at prepare time. If it
+When true, C<< $c->request->user_agent >> will be checked at prepare time. If it
is not the same as the user agent that initiated the session, the session is
deleted.
Devin Austin (dhoss) <dhoss@cpan.org>
+Robert Rothenberg <rrwo@cpan.org> (on behalf of Foxtons Ltd.)
+
=head1 COPYRIGHT & LICENSE
Copyright (c) 2005 the aforementioned authors. All rights
projects / catagits/Catalyst-Plugin-Session.git / blobdiff