README
1NAME
2 Catalyst::Plugin::Session::State::Cookie - Maintain session IDs using
3 cookies.
4
5SYNOPSIS
6 use Catalyst qw/Session Session::State::Cookie Session::Store::Foo/;
7
8DESCRIPTION
9 In order for Catalyst::Plugin::Session to work the session ID needs to
10 be stored on the client, and the session data needs to be stored on the
11 server.
12
13 This plugin stores the session ID on the client using the cookie
14 mechanism.
15
16METHODS
17 make_session_cookie
18 Returns a hash reference with the default values for new cookies.
19
20 update_session_cookie $hash_ref
21 Sets the cookie based on "cookie_name" in the response object.
22
23 calc_expiry
24 calculate_session_cookie_expires
25 cookie_is_rejecting
26 delete_session_id
27 extend_session_id
28 get_session_cookie
29 get_session_id
30 set_session_id
31
32EXTENDED METHODS
33 prepare_cookies
34 Will restore if an appropriate cookie is found.
35
36 finalize_cookies
37 Will set a cookie called "session" if it doesn't exist or if its
38 value is not the current session id.
39
40 setup_session
41 Will set the "cookie_name" parameter to its default value if it
42 isn't set.
43
44CONFIGURATION
45 cookie_name
46 The name of the cookie to store (defaults to
47 "Catalyst::Utils::apprefix($c) . '_session'").
48
49 cookie_domain
50 The name of the domain to store in the cookie (defaults to current
51 host)
52
53 cookie_expires
54 Number of seconds from now you want to elapse before cookie will
55 expire. Set to 0 to create a session cookie, ie one which will die
56 when the user's browser is shut down.
57
58 cookie_secure
59 If this attribute set to 0 the cookie will not have the secure flag.
60
61 If this attribute set to 1 (or true for backward compatibility) -
62 the cookie send by the server to the client will got the secure flag
63 that tells the browser to send this cookies back to the server only
64 via HTTPS.
65
66 If this attribute set to 2 then the cookie will got the secure flag
67 only if the request that caused cookie generation was sent over
68 https (this option is not good if you are mixing https and http in
69 you application).
70
71 Default vaule is 0.
72
73 cookie_httponly
74 If this attribute set to 0, the cookie will not have HTTPOnly flag.
75
76 If this attribute set to 1, the cookie will got HTTPOnly flag that
77 should prevent client side Javascript accessing the cookie value -
78 this makes some sort of session hijacking attacks significantly
79 harder. Unfortunately not all browsers support this flag (MSIE 6
80 SP1+, Firefox 3.0.0.6+, Opera 9.5+); if a browser is not aware of
81 HTTPOnly the flag will be ignored.
82
83 Default value is 1.
84
85 Note1: Many peole are confused by the name "HTTPOnly" - it does not
86 mean that this cookie works only over HTTP and not over HTTPS.
87
88 Note2: This paramater requires Catalyst::Runtime 5.80005 otherwise
89 is skipped.
90
91 cookie_path
92 The path of the request url where cookie should be baked.
93
94 For example, you could stick this in MyApp.pm:
95
96 __PACKAGE__->config( 'Plugin::Session' => {
97 cookie_domain => '.mydomain.com',
98 });
99
100CAVEATS
101 Sessions have to be created before the first write to be saved. For
102 example:
103
104 sub action : Local {
105 my ( $self, $c ) = @_;
106 $c->res->write("foo");
107 $c->session( ... );
108 ...
109 }
110
111 Will cause a session ID to not be set, because by the time a session is
112 actually created the headers have already been sent to the client.
113
114SEE ALSO
115 Catalyst, Catalyst::Plugin::Session.
116
117AUTHORS
118 Yuval Kogman <nothingmuch@woobling.org>
119
120CONTRIBUTORS
121 This module is derived from Catalyst::Plugin::Session::FastMmap code,
122 and has been heavily modified since.
123
124 Andrew Ford
125 Andy Grundman
126 Christian Hansen
127 Marcus Ramberg
128 Jonathan Rockway E<lt>jrockway@cpan.orgE<gt>
129 Sebastian Riedel
130 Florian Ragwitz
131
132COPYRIGHT
133 Copyright (c) 2005 - 2009 the Catalyst::Plugin::Session::State::Cookie
134 "AUTHORS" and "CONTRIBUTORS" as listed above.
135
136LICENSE
137 This program is free software, you can redistribute it and/or modify it
138 under the same terms as Perl itself.
139
140