X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=blobdiff_plain;f=lib%2FCatalyst%2FPlugin%2FSession.pm;h=470fd113affb26155dcef9e0b3fec647689ab001;hb=refs%2Fremotes%2Fmirror%2Fpeople%2Fdhoss%2Ffix-rt-71142;hp=9fff66ea39bbf42ec1df3c09bee746f6be17d2e1;hpb=c0c50a2c30c01d1a7696a17298f23f2e12617cdd;p=catagits%2FCatalyst-Plugin-Session.git diff --git a/lib/Catalyst/Plugin/Session.pm b/lib/Catalyst/Plugin/Session.pm index 9fff66e..470fd11 100644 --- a/lib/Catalyst/Plugin/Session.pm +++ b/lib/Catalyst/Plugin/Session.pm @@ -13,7 +13,8 @@ use Carp; use namespace::clean -except => 'meta'; -our $VERSION = '0.21'; +our $VERSION = '0.33'; +$VERSION = eval $VERSION; my @session_data_accessors; # used in delete_session @@ -35,6 +36,14 @@ __PACKAGE__->mk_accessors( / ); +sub _session_plugin_config { + my $c = shift; + # FIXME - Start warning once all the state/store modules have also been updated. + #$c->log->warn("Deprecated 'session' config key used, please use the key 'Plugin::Session' instead") + # if exists $c->config->{session} + #$c->config->{'Plugin::Session'} ||= delete($c->config->{session}) || {}; + $c->config->{'Plugin::Session'} ||= $c->config->{session} || {}; +} sub setup { my $c = shift; @@ -65,11 +74,12 @@ sub check_session_plugin_requirements { sub setup_session { my $c = shift; - my $cfg = ( $c->config->{session} ||= {} ); + my $cfg = $c->_session_plugin_config; %$cfg = ( expires => 7200, verify_address => 0, + verify_user_agent => 0, %$cfg, ); @@ -79,21 +89,23 @@ sub setup_session { sub prepare_action { my $c = shift; - if ( $c->config->{session}{flash_to_stash} + $c->maybe::next::method(@_); + + if ( $c->_session_plugin_config->{flash_to_stash} and $c->sessionid and my $flash_data = $c->flash ) { @{ $c->stash }{ keys %$flash_data } = values %$flash_data; } - - $c->maybe::next::method(@_); } sub finalize_headers { my $c = shift; - # fix cookie before we send headers - $c->_save_session_expires; + # Force extension of session_expires before finalizing headers, so a possible cookie will be + # up to date. First call to session_expires will extend the expiry, subsequent calls will + # just return the previously extended value. + $c->session_expires; return $c->maybe::next::method(@_); } @@ -114,6 +126,7 @@ sub finalize_session { $c->maybe::next::method(@_); + $c->_save_session_expires; $c->_save_session_id; $c->_save_session; $c->_save_flash; @@ -167,7 +180,7 @@ sub _save_flash { delete $flash_data->{$key}; } } - + my $sid = $c->sessionid; my $session_data = $c->_session; @@ -214,7 +227,8 @@ sub _load_session { $c->_session($session_data); no warnings 'uninitialized'; # ne __address - if ( $c->config->{session}{verify_address} + if ( $c->_session_plugin_config->{verify_address} + && exists $session_data->{__address} && $session_data->{__address} ne $c->request->address ) { $c->log->warn( @@ -225,6 +239,17 @@ sub _load_session { $c->delete_session("address mismatch"); return; } + if ( $c->_session_plugin_config->{verify_user_agent} + && $session_data->{__user_agent} ne $c->request->user_agent ) + { + $c->log->warn( + "Deleting session $sid due to user agent mismatch (" + . $session_data->{__user_agent} . " != " + . $c->request->user_agent . ")" + ); + $c->delete_session("user agent mismatch"); + return; + } $c->log->debug(qq/Restored session "$sid"/) if $c->debug; $c->_session_data_sig( Object::Signature::signature($session_data) ) if $session_data; @@ -250,7 +275,7 @@ sub _load_flash { if ( my $flash_data = $c->_flash ) { $c->_flash_key_hashes({ map { $_ => Object::Signature::signature( \$flash_data->{$_} ) } keys %$flash_data }); - + return $flash_data; } } @@ -276,6 +301,24 @@ sub _clear_session_instance_data { $c->maybe::next::method(@_); # allow other plugins to hook in on this } +sub change_session_id { + my $c = shift; + + my $sessiondata = $c->session; + my $oldsid = $c->sessionid; + my $newsid = $c->create_session_id; + + if ($oldsid) { + $c->log->debug(qq/change_sessid: deleting session data from "$oldsid"/) if $c->debug; + $c->delete_session_data("${_}:${oldsid}") for qw/session expires flash/; + } + + $c->log->debug(qq/change_sessid: storing session data to "$newsid"/) if $c->debug; + $c->store_session_data( "session:$newsid" => $sessiondata ); + + return $newsid; +} + sub delete_session { my ( $c, $msg ) = @_; @@ -323,7 +366,7 @@ sub extend_session_expires { sub calculate_initial_session_expires { my $c = shift; - return ( time() + $c->config->{session}{expires} ); + return ( time() + $c->_session_plugin_config->{expires} ); } sub calculate_extended_session_expires { @@ -333,16 +376,21 @@ sub calculate_extended_session_expires { sub reset_session_expires { my ( $c, $sid ) = @_; - + my $exp = $c->calculate_initial_session_expires; $c->_session_expires( $exp ); + # + # since we're setting _session_expires directly, make load_session_expires + # actually use that value. + # + $c->_tried_loading_session_expires(1); $c->_extended_session_expires( $exp ); $exp; } sub sessionid { my $c = shift; - + return $c->_sessionid || $c->_load_sessionid; } @@ -386,10 +434,21 @@ sub validate_session_id { sub session { my $c = shift; - $c->_session || $c->_load_session || do { + my $session = $c->_session || $c->_load_session || do { $c->create_session_id_if_needed; $c->initialize_session_data; }; + + if (@_) { + my $new_values = @_ > 1 ? { @_ } : $_[0]; + croak('session takes a hash or hashref') unless ref $new_values; + + for my $key (keys %$new_values) { + $session->{$key} = $new_values->{$key}; + } + } + + $session; } sub keep_flash { @@ -398,7 +457,7 @@ sub keep_flash { (@{$href}{@keys}) = ((undef) x @keys); } -sub _flash_data { +sub _flash_data { my $c = shift; $c->_flash || $c->_load_flash || do { $c->create_session_id_if_needed; @@ -424,7 +483,7 @@ sub flash { sub clear_flash { my $c = shift; - + #$c->delete_session_data("flash:" . $c->sessionid); # should this be in here? or delayed till finalization? $c->_flash_key_hashes({}); $c->_flash_keep_keys({}); @@ -450,8 +509,13 @@ sub initialize_session_data { __updated => $now, ( - $c->config->{session}{verify_address} - ? ( __address => $c->request->address ) + $c->_session_plugin_config->{verify_address} + ? ( __address => $c->request->address||'' ) + : () + ), + ( + $c->_session_plugin_config->{verify_user_agent} + ? ( __user_agent => $c->request->user_agent||'' ) : () ), } @@ -473,7 +537,7 @@ sub create_session_id_if_needed { sub create_session_id { my $c = shift; - + my $sid = $c->generate_session_id; $c->log->debug(qq/Created session "$sid"/) if $c->debug; @@ -518,7 +582,7 @@ sub dump_these { ( $c->maybe::next::method(), - $c->sessionid + $c->_sessionid ? ( [ "Session ID" => $c->sessionid ], [ Session => $c->session ], ) : () ); @@ -634,6 +698,13 @@ requests. This method will automatically create a new session and session ID if none exists. +You can also set session keys by passing a list of key/value pairs or a +hashref. + + $c->session->{foo} = "bar"; # This works. + $c->session(one => 1, two => 2); # And this. + $c->session({ answer => 42 }); # And this. + =item session_expires =item session_expires $reset @@ -656,6 +727,15 @@ $c->flash (thus allowing multiple redirections), and the policy is to delete all the keys which haven't changed since the flash data was loaded at the end of every request. +Note that use of the flash is an easy way to get data across requests, but +it's also strongly disrecommended, due it it being inherently plagued with +race conditions. This means that it's unlikely to work well if your +users have multiple tabs open at once, or if your site does a lot of AJAX +requests. + +L is the recommended alternative solution, +as this doesn't suffer from these issues. + sub moose : Local { my ( $self, $c ) = @_; @@ -677,7 +757,7 @@ of every request. my ( $self, $c ) = @_; if ( exists $c->flash->{beans} ) { # false - + } } @@ -721,7 +801,8 @@ expiry time for the whole session). For example: - __PACKAGE__->config->{session}{expires} = 1000000000000; # forever + __PACKAGE__->config('Plugin::Session' => { expires => 10000000000 }); # "forever" + (NB If this number is too large, Y2K38 breakage could result.) # later @@ -732,6 +813,31 @@ an hour. Note that these values are not auto extended. +=item change_session_id + +By calling this method you can force a session id change while keeping all +session data. This method might come handy when you are paranoid about some +advanced variations of session fixation attack. + +If you want to prevent this session fixation scenario: + + 0) let us have WebApp with anonymous and authenticated parts + 1) a hacker goes to vulnerable WebApp and gets a real sessionid, + just by browsing anonymous part of WebApp + 2) the hacker inserts (somehow) this values into a cookie in victim's browser + 3) after the victim logs into WebApp the hacker can enter his/her session + +you should call change_session_id in your login controller like this: + + if ($c->authenticate( { username => $user, password => $pass } )) { + # login OK + $c->change_session_id; + ... + } else { + # login FAILED + ... + } + =back =head1 INTERNAL METHODS @@ -750,7 +856,7 @@ application. =item setup_session -This method populates C<< $c->config->{session} >> with the default values +This method populates C<< $c->config('Plugin::Session') >> with the default values listed in L. =item prepare_action @@ -894,12 +1000,12 @@ the store. =head1 CONFIGURATION - $c->config->{session} = { + $c->config('Plugin::Session' => { expires => 1234, - }; + }); All configuation parameters are provided in a hash reference under the -C key in the configuration hash. +C key in the configuration hash. =over 4 @@ -915,6 +1021,14 @@ not the same as the address that initiated the session, the session is deleted. Defaults to false. +=item verify_user_agent + +When true, C<<$c->request->user_agent>> will be checked at prepare time. If it +is not the same as the user agent that initiated the session, the session is +deleted. + +Defaults to false. + =item flash_to_stash This option makes it easier to have actions behave the same whether they were @@ -947,6 +1061,11 @@ The time when the session was first created. The value of C<< $c->request->address >> at the time the session was created. This value is only populated if C is true in the configuration. +=item __user_agent + +The value of C<< $c->request->user_agent >> at the time the session was created. +This value is only populated if C is true in the configuration. + =back =head1 CAVEATS @@ -1000,11 +1119,8 @@ changes by request a =back -If this is a concern in your application, a soon-to-be-developed locking -solution is the only safe way to go. This will have a bigger overhead. - -For applications where any given user is only making one request at a time this -plugin should be safe enough. +For applications where any given user's session is only making one request +at a time this plugin should be safe enough. =head1 AUTHORS @@ -1020,8 +1136,18 @@ Tomas Doran (t0m) C (current maintainer) Sergio Salvi +kmx C + +Florian Ragwitz (rafl) C + +Kent Fredric (kentnl) + And countless other contributers from #catalyst. Thanks guys! +=head1 Contributors + +Devin Austin (dhoss) + =head1 COPYRIGHT & LICENSE Copyright (c) 2005 the aforementioned authors. All rights