X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=blobdiff_plain;f=lib%2FCatalyst%2FPlugin%2FSession.pm;h=345297fde9d75db316c4c159a7fc5d1d815a1d9b;hb=005dfe4f232485eb89f321eefed95adf1eb60097;hp=ee7c7ea4aa7a495251d0137b7a62df837b64eff3;hpb=1961343c9a2db527a386830ac9ee195cf7bd5983;p=catagits%2FCatalyst-Plugin-Session.git diff --git a/lib/Catalyst/Plugin/Session.pm b/lib/Catalyst/Plugin/Session.pm index ee7c7ea..345297f 100644 --- a/lib/Catalyst/Plugin/Session.pm +++ b/lib/Catalyst/Plugin/Session.pm @@ -1,23 +1,26 @@ #!/usr/bin/perl package Catalyst::Plugin::Session; -use base qw/Class::Accessor::Fast/; -use strict; -use warnings; - -use NEXT; +use Moose; +with 'MooseX::Emulate::Class::Accessor::Fast'; +use MRO::Compat; use Catalyst::Exception (); use Digest (); use overload (); use Object::Signature (); +use HTML::Entities (); use Carp; +use List::Util qw/ max /; + +use namespace::clean -except => 'meta'; -our $VERSION = "0.19"; +our $VERSION = '0.41'; +$VERSION = eval $VERSION; my @session_data_accessors; # used in delete_session -BEGIN { - __PACKAGE__->mk_accessors( + +__PACKAGE__->mk_accessors( "_session_delete_reason", @session_data_accessors = qw/ _sessionid @@ -32,14 +35,23 @@ BEGIN { _tried_loading_session_data _tried_loading_session_expires _tried_loading_flash_data + _needs_early_session_finalization / - ); +); + +sub _session_plugin_config { + my $c = shift; + # FIXME - Start warning once all the state/store modules have also been updated. + #$c->log->warn("Deprecated 'session' config key used, please use the key 'Plugin::Session' instead") + # if exists $c->config->{session} + #$c->config->{'Plugin::Session'} ||= delete($c->config->{session}) || {}; + $c->config->{'Plugin::Session'} ||= $c->config->{session} || {}; } sub setup { my $c = shift; - $c->NEXT::setup(@_); + $c->maybe::next::method(@_); $c->check_session_plugin_requirements; $c->setup_session; @@ -65,28 +77,30 @@ sub check_session_plugin_requirements { sub setup_session { my $c = shift; - my $cfg = ( $c->config->{session} ||= {} ); + my $cfg = $c->_session_plugin_config; %$cfg = ( expires => 7200, verify_address => 0, + verify_user_agent => 0, + expiry_threshold => 0, %$cfg, ); - $c->NEXT::setup_session(); + $c->maybe::next::method(); } sub prepare_action { my $c = shift; - if ( $c->config->{session}{flash_to_stash} + $c->maybe::next::method(@_); + + if ( $c->_session_plugin_config->{flash_to_stash} and $c->sessionid and my $flash_data = $c->flash ) { @{ $c->stash }{ keys %$flash_data } = values %$flash_data; } - - $c->NEXT::prepare_action(@_); } sub finalize_headers { @@ -95,28 +109,57 @@ sub finalize_headers { # fix cookie before we send headers $c->_save_session_expires; - return $c->NEXT::finalize_headers(@_); + # Force extension of session_expires before finalizing headers, so a pos + # up to date. First call to session_expires will extend the expiry, subs + # just return the previously extended value. + $c->session_expires; + $c->finalize_session if $c->_needs_early_session_finalization; + + return $c->maybe::next::method(@_); } -sub finalize { +sub finalize_body { my $c = shift; - my $ret = $c->NEXT::finalize(@_); - # then finish the rest - $c->finalize_session; - return $ret; + # We have to finalize our session *before* $c->engine->finalize_xxx is called, + # because we do not want to send the HTTP response before the session is stored/committed to + # the session database (or whatever Session::Store you use). + $c->finalize_session unless $c->_needs_early_session_finalization; + $c->_clear_session_instance_data; + + return $c->maybe::next::method(@_); } sub finalize_session { my $c = shift; - $c->NEXT::finalize_session; + $c->maybe::next::method(@_); $c->_save_session_id; $c->_save_session; $c->_save_flash; - $c->_clear_session_instance_data; +} + +sub _session_updated { + my $c = shift; + + if ( my $session_data = $c->_session ) { + + no warnings 'uninitialized'; + if ( Object::Signature::signature($session_data) ne + $c->_session_data_sig ) + { + return $session_data; + } else { + return; + } + + } else { + + return; + + } } sub _save_session_id { @@ -130,26 +173,27 @@ sub _save_session_expires { my $c = shift; if ( defined($c->_session_expires) ) { - my $expires = $c->session_expires; # force extension - my $sid = $c->sessionid; - $c->store_session_data( "expires:$sid" => $expires ); + if (my $sid = $c->sessionid) { + + my $current = $c->_get_stored_session_expires; + my $extended = $c->session_expires; + if ($extended > $current) { + $c->store_session_data( "expires:$sid" => $extended ); + } + + } } } sub _save_session { my $c = shift; - if ( my $session_data = $c->_session ) { + if ( my $session_data = $c->_session_updated ) { - no warnings 'uninitialized'; - if ( Object::Signature::signature($session_data) ne - $c->_session_data_sig ) - { - $session_data->{__updated} = time(); - my $sid = $c->sessionid; - $c->store_session_data( "session:$sid" => $session_data ); - } + $session_data->{__updated} = time(); + my $sid = $c->sessionid; + $c->store_session_data( "session:$sid" => $session_data ); } } @@ -165,15 +209,18 @@ sub _save_flash { delete $flash_data->{$key}; } } - + my $sid = $c->sessionid; + my $session_data = $c->_session; if (%$flash_data) { - $c->store_session_data( "flash:$sid", $flash_data ); + $session_data->{__flash} = $flash_data; } else { - $c->delete_session_data("flash:$sid"); + delete $session_data->{__flash}; } + $c->_session($session_data); + $c->_save_session; } } @@ -183,7 +230,7 @@ sub _load_session_expires { $c->_tried_loading_session_expires(1); if ( my $sid = $c->sessionid ) { - my $expires = $c->get_session_data("expires:$sid") || 0; + my $expires = $c->_get_stored_session_expires; if ( $expires >= time() ) { $c->_session_expires( $expires ); @@ -209,7 +256,8 @@ sub _load_session { $c->_session($session_data); no warnings 'uninitialized'; # ne __address - if ( $c->config->{session}{verify_address} + if ( $c->_session_plugin_config->{verify_address} + && exists $session_data->{__address} && $session_data->{__address} ne $c->request->address ) { $c->log->warn( @@ -220,6 +268,17 @@ sub _load_session { $c->delete_session("address mismatch"); return; } + if ( $c->_session_plugin_config->{verify_user_agent} + && $session_data->{__user_agent} ne $c->request->user_agent ) + { + $c->log->warn( + "Deleting session $sid due to user agent mismatch (" + . $session_data->{__user_agent} . " != " + . $c->request->user_agent . ")" + ); + $c->delete_session("user agent mismatch"); + return; + } $c->log->debug(qq/Restored session "$sid"/) if $c->debug; $c->_session_data_sig( Object::Signature::signature($session_data) ) if $session_data; @@ -238,11 +297,14 @@ sub _load_flash { $c->_tried_loading_flash_data(1); if ( my $sid = $c->sessionid ) { - if ( my $flash_data = $c->_flash - || $c->_flash( $c->get_session_data("flash:$sid") ) ) + + my $session_data = $c->session; + $c->_flash($session_data->{__flash}); + + if ( my $flash_data = $c->_flash ) { $c->_flash_key_hashes({ map { $_ => Object::Signature::signature( \$flash_data->{$_} ) } keys %$flash_data }); - + return $flash_data; } } @@ -265,7 +327,25 @@ sub _expire_session_keys { sub _clear_session_instance_data { my $c = shift; $c->$_(undef) for @session_data_accessors; - $c->NEXT::_clear_session_instance_data; # allow other plugins to hook in on this + $c->maybe::next::method(@_); # allow other plugins to hook in on this +} + +sub change_session_id { + my $c = shift; + + my $sessiondata = $c->session; + my $oldsid = $c->sessionid; + my $newsid = $c->create_session_id; + + if ($oldsid) { + $c->log->debug(qq/change_sessid: deleting session data from "$oldsid"/) if $c->debug; + $c->delete_session_data("${_}:${oldsid}") for qw/session expires flash/; + } + + $c->log->debug(qq/change_sessid: storing session data to "$newsid"/) if $c->debug; + $c->store_session_data( "session:$newsid" => $sessiondata ); + + return $newsid; } sub delete_session { @@ -308,33 +388,85 @@ sub session_expires { sub extend_session_expires { my ( $c, $expires ) = @_; - $c->_extended_session_expires( my $updated = $c->calculate_extended_session_expires( $expires ) ); - $c->extend_session_id( $c->sessionid, $updated ); - return $updated; + + my $threshold = $c->_session_plugin_config->{expiry_threshold} || 0; + + if ( my $sid = $c->sessionid ) { + my $expires = $c->_get_stored_session_expires; + my $cutoff = $expires - $threshold; + + if (!$threshold || $cutoff <= time || $c->_session_updated) { + + $c->_extended_session_expires( my $updated = $c->calculate_initial_session_expires() ); + $c->extend_session_id( $sid, $updated ); + + return $updated; + + } else { + + return $expires; + + } + + } else { + + return; + + } + } -sub calculate_initial_session_expires { +sub change_session_expires { + my ( $c, $expires ) = @_; + + $expires ||= 0; + my $sid = $c->sessionid; + my $time_exp = time() + $expires; + $c->store_session_data( "expires:$sid" => $time_exp ); +} + +sub _get_stored_session_expires { + my ($c) = @_; + + if ( my $sid = $c->sessionid ) { + return $c->get_session_data("expires:$sid") || 0; + } else { + return 0; + } +} + +sub initial_session_expires { my $c = shift; - return ( time() + $c->config->{session}{expires} ); + return ( time() + $c->_session_plugin_config->{expires} ); +} + +sub calculate_initial_session_expires { + my ($c) = @_; + return max( $c->initial_session_expires, $c->_get_stored_session_expires ); } sub calculate_extended_session_expires { my ( $c, $prev ) = @_; - $c->calculate_initial_session_expires; + return ( time() + $prev ); } sub reset_session_expires { my ( $c, $sid ) = @_; - + my $exp = $c->calculate_initial_session_expires; $c->_session_expires( $exp ); + # + # since we're setting _session_expires directly, make load_session_expires + # actually use that value. + # + $c->_tried_loading_session_expires(1); $c->_extended_session_expires( $exp ); $exp; } sub sessionid { my $c = shift; - + return $c->_sessionid || $c->_load_sessionid; } @@ -349,6 +481,7 @@ sub _load_sessionid { $c->_sessionid($sid); return $sid; } else { + $sid = HTML::Entities::encode_entities($sid); my $err = "Tried to set invalid session ID '$sid'"; $c->log->error($err); Catalyst::Exception->throw($err); @@ -378,10 +511,21 @@ sub validate_session_id { sub session { my $c = shift; - $c->_session || $c->_load_session || do { + my $session = $c->_session || $c->_load_session || do { $c->create_session_id_if_needed; $c->initialize_session_data; }; + + if (@_) { + my $new_values = @_ > 1 ? { @_ } : $_[0]; + croak('session takes a hash or hashref') unless ref $new_values; + + for my $key (keys %$new_values) { + $session->{$key} = $new_values->{$key}; + } + } + + $session; } sub keep_flash { @@ -390,7 +534,7 @@ sub keep_flash { (@{$href}{@keys}) = ((undef) x @keys); } -sub _flash_data { +sub _flash_data { my $c = shift; $c->_flash || $c->_load_flash || do { $c->create_session_id_if_needed; @@ -416,7 +560,7 @@ sub flash { sub clear_flash { my $c = shift; - + #$c->delete_session_data("flash:" . $c->sessionid); # should this be in here? or delayed till finalization? $c->_flash_key_hashes({}); $c->_flash_keep_keys({}); @@ -442,8 +586,13 @@ sub initialize_session_data { __updated => $now, ( - $c->config->{session}{verify_address} - ? ( __address => $c->request->address ) + $c->_session_plugin_config->{verify_address} + ? ( __address => $c->request->address||'' ) + : () + ), + ( + $c->_session_plugin_config->{verify_user_agent} + ? ( __user_agent => $c->request->user_agent||'' ) : () ), } @@ -465,7 +614,7 @@ sub create_session_id_if_needed { sub create_session_id { my $c = shift; - + my $sid = $c->generate_session_id; $c->log->debug(qq/Created session "$sid"/) if $c->debug; @@ -508,21 +657,21 @@ sub dump_these { my $c = shift; ( - $c->NEXT::dump_these(), + $c->maybe::next::method(), - $c->sessionid + $c->_sessionid ? ( [ "Session ID" => $c->sessionid ], [ Session => $c->session ], ) : () ); } -sub get_session_id { shift->NEXT::get_session_id(@_) } -sub set_session_id { shift->NEXT::set_session_id(@_) } -sub delete_session_id { shift->NEXT::delete_session_id(@_) } -sub extend_session_id { shift->NEXT::extend_session_id(@_) } +sub get_session_id { shift->maybe::next::method(@_) } +sub set_session_id { shift->maybe::next::method(@_) } +sub delete_session_id { shift->maybe::next::method(@_) } +sub extend_session_id { shift->maybe::next::method(@_) } -__PACKAGE__; +__PACKAGE__->meta->make_immutable; __END__ @@ -530,8 +679,7 @@ __END__ =head1 NAME -Catalyst::Plugin::Session - Generic Session plugin - ties together server side -storage and client side state required to maintain session data. +Catalyst::Plugin::Session - Generic Session plugin - ties together server side storage and client side state required to maintain session data. =head1 SYNOPSIS @@ -543,11 +691,11 @@ storage and client side state required to maintain session data. Session::State::Cookie /; - # you can replace Store::FastMmap with Store::File - both have sensible - # default configurations (see their docs for details) + # you can replace Store::FastMmap with Store::File - both have sensible + # default configurations (see their docs for details) - # more complicated backends are available for other scenarios (DBI storage, - # etc) + # more complicated backends are available for other scenarios (DBI storage, + # etc) # after you've loaded the plugins you can save session data @@ -627,18 +775,19 @@ requests. This method will automatically create a new session and session ID if none exists. -=item session_expires +You can also set session keys by passing a list of key/value pairs or a +hashref. -=item session_expires $reset + $c->session->{foo} = "bar"; # This works. + $c->session(one => 1, two => 2); # And this. + $c->session({ answer => 42 }); # And this. + +=item session_expires This method returns the time when the current session will expire, or 0 if there is no current session. If there is a session and it already expired, it will delete the session and return 0 as well. -If the C<$reset> parameter is true, and there is a session ID the expiry time -will be reset to the current time plus the time to live (see -L). This is used when creating a new session. - =item flash This is like Ruby on Rails' flash data structure. Think of it as a stash that @@ -649,6 +798,15 @@ $c->flash (thus allowing multiple redirections), and the policy is to delete all the keys which haven't changed since the flash data was loaded at the end of every request. +Note that use of the flash is an easy way to get data across requests, but +it's also strongly disrecommended, due it it being inherently plagued with +race conditions. This means that it's unlikely to work well if your +users have multiple tabs open at once, or if your site does a lot of AJAX +requests. + +L is the recommended alternative solution, +as this doesn't suffer from these issues. + sub moose : Local { my ( $self, $c ) = @_; @@ -670,7 +828,7 @@ of every request. my ( $self, $c ) = @_; if ( exists $c->flash->{beans} ) { # false - + } } @@ -688,6 +846,8 @@ changed, call C and pass in the keys as arguments. This method is used to invalidate a session. It takes an optional parameter which will be saved in C if provided. +NOTE: This method will B delete your flash data. + =item session_delete_reason This accessor contains a string with the reason a session was deleted. Possible @@ -712,7 +872,8 @@ expiry time for the whole session). For example: - __PACKAGE__->config->{session}{expires} = 1000000000000; # forever + __PACKAGE__->config('Plugin::Session' => { expires => 10000000000 }); # "forever" + (NB If this number is too large, Y2K38 breakage could result.) # later @@ -723,6 +884,39 @@ an hour. Note that these values are not auto extended. +=item change_session_id + +By calling this method you can force a session id change while keeping all +session data. This method might come handy when you are paranoid about some +advanced variations of session fixation attack. + +If you want to prevent this session fixation scenario: + + 0) let us have WebApp with anonymous and authenticated parts + 1) a hacker goes to vulnerable WebApp and gets a real sessionid, + just by browsing anonymous part of WebApp + 2) the hacker inserts (somehow) this values into a cookie in victim's browser + 3) after the victim logs into WebApp the hacker can enter his/her session + +you should call change_session_id in your login controller like this: + + if ($c->authenticate( { username => $user, password => $pass } )) { + # login OK + $c->change_session_id; + ... + } else { + # login FAILED + ... + } + +=item change_session_expires $expires + +You can change the session expiration time for this session; + + $c->change_session_expires( 4000 ); + +Note that this only works to set the session longer than the config setting. + =back =head1 INTERNAL METHODS @@ -741,14 +935,14 @@ application. =item setup_session -This method populates C<< $c->config->{session} >> with the default values +This method populates C<< $c->config('Plugin::Session') >> with the default values listed in L. =item prepare_action -This methoid is extended. +This method is extended. -It's only effect is if the (off by default) C configuration +Its only effect is if the (off by default) C configuration parameter is on - then it will copy the contents of the flash to the stash at prepare time. @@ -757,10 +951,10 @@ prepare time. This method is extended and will extend the expiry time before sending the response. -=item finalize +=item finalize_body -This method is extended and will call finalize_session after the other -finalizes run. Here we persist the session data if a session exists. +This method is extended and will call finalize_session before the other +finalize_body methods run. Here we persist the session data if a session exists. =item initialize_session_data @@ -769,7 +963,7 @@ called by the C method if appropriate. =item create_session_id -Creates a new session id using C if there is no session ID +Creates a new session ID using C if there is no session ID yet. =item validate_session_id SID @@ -784,7 +978,7 @@ insensitive hexadecimal characters. This method will return a string that can be used as a session ID. It is supposed to be a reasonably random string with enough bits to prevent collision. It basically takes C and hashes it using SHA-1, -MD5 or SHA-256, depending on the availibility of these modules. +MD5 or SHA-256, depending on the availability of these modules. =item session_hash_seed @@ -795,29 +989,19 @@ Currently it returns a concatenated string which contains: =over 4 -=item * - -A counter - -=item * - -The current time - -=item * +=item * A counter -One value from C. - -=item * +=item * The current time -The stringified value of a newly allocated hash reference +=item * One value from C. -=item * +=item * The stringified value of a newly allocated hash reference -The stringified value of the Catalyst context object +=item * The stringified value of the Catalyst context object =back -In the hopes that those combined values are entropic enough for most uses. If +in the hopes that those combined values are entropic enough for most uses. If this is not the case you can replace C with e.g. sub session_hash_seed { @@ -861,6 +1045,9 @@ dumped objects if session ID is defined. =item extend_session_expires +Note: this is *not* used to give an individual user a longer session. See +'change_session_expires'. + =item extend_session_id =item get_session_id @@ -871,6 +1058,8 @@ dumped objects if session ID is defined. =item set_session_id +=item initial_session_expires + =back =head1 USING SESSIONS DURING PREPARE @@ -882,25 +1071,25 @@ State plugins must set $c->session ID before C, and during C L will actually load the data from the store. - sub prepare_action { - my $c = shift; + sub prepare_action { + my $c = shift; - # don't touch $c->session yet! + # don't touch $c->session yet! - $c->NEXT::prepare_action( @_ ); + $c->NEXT::prepare_action( @_ ); - $c->session; # this is OK - $c->sessionid; # this is also OK - } + $c->session; # this is OK + $c->sessionid; # this is also OK + } =head1 CONFIGURATION - $c->config->{session} = { + $c->config('Plugin::Session' => { expires => 1234, - }; + }); All configuation parameters are provided in a hash reference under the -C key in the configuration hash. +C key in the configuration hash. =over 4 @@ -909,13 +1098,31 @@ C key in the configuration hash. The time-to-live of each session, expressed in seconds. Defaults to 7200 (two hours). +=item expiry_threshold + +Only update the session expiry time if it would otherwise expire +within this many seconds from now. + +The purpose of this is to keep the session store from being updated +when nothing else in the session is updated. + +Defaults to 0 (in which case, the expiration will always be updated). + =item verify_address -When true, C<<$c->request->address>> will be checked at prepare time. If it is +When true, C<< $c->request->address >> will be checked at prepare time. If it is not the same as the address that initiated the session, the session is deleted. Defaults to false. +=item verify_user_agent + +When true, C<< $c->request->user_agent >> will be checked at prepare time. If it +is not the same as the user agent that initiated the session, the session is +deleted. + +Defaults to false. + =item flash_to_stash This option makes it easier to have actions behave the same whether they were @@ -948,6 +1155,11 @@ The time when the session was first created. The value of C<< $c->request->address >> at the time the session was created. This value is only populated if C is true in the configuration. +=item __user_agent + +The value of C<< $c->request->user_agent >> at the time the session was created. +This value is only populated if C is true in the configuration. + =back =head1 CAVEATS @@ -962,13 +1174,13 @@ users' sessions cannot persist. To let these users access your site you can either disable address verification as a whole, or provide a checkbox in the login dialog that tells the server that it's OK for the address of the client to change. When the server sees that -this box is checked it should delete the C<__address> sepcial key from the +this box is checked it should delete the C<__address> special key from the session hash when the hash is first created. =head2 Race Conditions -In this day and age where cleaning detergents and dutch football (not the -american kind) teams roam the plains in great numbers, requests may happen +In this day and age where cleaning detergents and Dutch football (not the +American kind) teams roam the plains in great numbers, requests may happen simultaneously. This means that there is some risk of session data being overwritten, like this: @@ -976,7 +1188,7 @@ overwritten, like this: =item 1. -request a starts, request b starts, with the same session id +request a starts, request b starts, with the same session ID =item 2. @@ -1001,33 +1213,42 @@ changes by request a =back -If this is a concern in your application, a soon to be developed locking -solution is the only safe way to go. This will have a bigger overhead. - -For applications where any given user is only making one request at a time this -plugin should be safe enough. +For applications where any given user's session is only making one request +at a time this plugin should be safe enough. =head1 AUTHORS -=over 4 +Andy Grundman -=item Andy Grundman +Christian Hansen -=item Christian Hansen +Yuval Kogman, C -=item Yuval Kogman, C (current maintainer) +Sebastian Riedel -=item Sebastian Riedel +Tomas Doran (t0m) C (current maintainer) -=back +Sergio Salvi + +kmx C + +Florian Ragwitz (rafl) C + +Kent Fredric (kentnl) And countless other contributers from #catalyst. Thanks guys! +=head1 Contributors + +Devin Austin (dhoss) + +Robert Rothenberg (on behalf of Foxtons Ltd.) + =head1 COPYRIGHT & LICENSE - Copyright (c) 2005 the aforementioned authors. All rights - reserved. This program is free software; you can redistribute - it and/or modify it under the same terms as Perl itself. + Copyright (c) 2005 the aforementioned authors. All rights + reserved. This program is free software; you can redistribute + it and/or modify it under the same terms as Perl itself. =cut