no temporary variable

[catagits/Web-Session.git] / lib / Plack / Session / State.pm

diff --git a/lib/Plack/Session/State.pm b/lib/Plack/Session/State.pm
index 10a1368..6f72c78 100644 (file)
--- a/lib/Plack/Session/State.pm
+++ b/lib/Plack/Session/State.pm
@@ -7,6 +7,7 @@ use Digest::SHA1 ();
 use Plack::Util::Accessor qw[
     session_key
     sid_generator
+    sid_validator
 ];
 
 sub new {
@@ -17,6 +18,7 @@ sub new {
     $params{'sid_generator'} ||= sub {
         Digest::SHA1::sha1_hex(rand() . $$ . {} . time)
     };
+    $params{'sid_validator'} ||= qr/\A[0-9a-f]{40}\Z/;
 
     bless { %params } => $class;
 }
@@ -37,16 +39,35 @@ sub check_expired {
     return $id;
 }
 
+sub validate_request_session_id {
+    my ($self, $request) = @_;
+
+    my $reqest_session_id = $self->get_request_session_id($request);
+
+    defined $reqest_session_id && $reqest_session_id =~ $self->sid_validator;
+}
+
 sub get_session_id {
     my ($self, $request) = @_;
-    $self->extract( $request )
+    (
+        $self->validate_request_session_id($request)
+        &&
+        $self->extract( $request )
+    )
         ||
     $self->generate( $request )
 }
 
+sub get_request_session_id {
+    my ($self, $request ) = @_;
+
+    $request->param( $self->session_key );
+}
+
 sub extract {
     my ($self, $request) = @_;
-    $self->check_expired( $request->param( $self->session_key ) );
+
+    $self->check_expired( $self->get_request_session_id($request) );
 }
 
 sub generate {
@@ -104,7 +125,7 @@ L<Plack::Session::State::Cookie> for an example of this.
 
 =item B<new ( %params )>
 
-The C<%params> can include I<session_key> and I<sid_generator>,
+The C<%params> can include I<session_key>, I<sid_generator> and I<sid_checker>
 however in both cases a default will be provided for you.
 
 =item B<session_key>
@@ -117,6 +138,10 @@ This is a CODE ref used to generate unique session ids, by default
 it will generate a SHA1 using fairly sufficient entropy. If you are
 concerned or interested, just read the source.
 
+=item B<sid_validator>
+
+This is a regex used to validate requested session id,
+
 =back
 
 =head2 Session ID Managment
@@ -130,6 +155,8 @@ if the is expired or does not exist, it will then generate a new
 session. The C<$request> is expected to be a L<Plack::Request> instance
 or an object with an equivalent interface.
 
+=item B<get_request_session_id ( $request )>
+
 =item B<extract ( $request )>
 
 This will attempt to extract the session from a C<$request> by looking