cromedome / cgi-session Goto Github PK

Latest commit in repository is for Sep 28, 2010 and CPAN has version from 11 Jul 2011.

Basic set up:
my $session = new CGI::Session();
....
print $session->header(); # creates a session cookie, rather one that has an expiry
$session->expiry("+5s"); # now the session has an expiry!

Next access (after 5 seconds) will cause the browser to send the session cookie (which is still valid), CGI::Session finds that the session has actually expired and so will generate a new session. However, the expired and deleted status flags are NOT cleared, hence the header() call will issue the NEW session cookie value with a date of -1d, hence scrubbing the new session cookie from the browser.

Note, the above code is to demonstrate the problem - my code is a lot more involved including redirects to 3rd party authentication, and print $session->header() is only used on the first initialization of the session, it's not repeated while a session is still "valid" (I want to check the session on the server side as it's not always possible to update the cookie expiry during the lifetime of a session).

Ugly workaround in my code:
my $session = new CGI::Session();
if ($session->is_expired && $session->is_new) {
$session->_unset_status( CGI::Session::STATUS_DELETED | CGI::Session::STATUS_EXPIRED );
}
....