/ 
Apache-AppSamurai-1.01
/ Apache::AppSamurai::Tracker
Security Advisories (1)
CVE-2026-19565 (2026-08-23)

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running digest, and the process id. CreateSession calls it with an empty key source on every login, and the optional Keysource directive is the only route to the other branch. The result is 64 hex characters. The microsecond field of the first reading takes one of a million values, the later readings follow it within microseconds, and the process id is drawn from a small range. The key is returned to the browser as the session cookie, and is combined with the configured server key to compute the session id and to encrypt the stored session data. An attacker who knows the second in which a session was created and the process id of the worker that created it can enumerate candidate keys and recover the victim's cookie, bypassing authentication for the protected resources. Each candidate has to be tried against the server, which validates the cookie with a key the attacker does not hold.

NAME

Apache::AppSamurai::Tracker - Apache::AppSamurai scratch-pad/tracking storage

SYNOPSIS

use Apache::AppSamurai::Tracker;
 
tie %hash, 'Apache::AppSamurai::Tracker', $id, {
   Store     => 'Apache::Session::Store::DB_File',
   Lock      => 'Null',
};
 
# Postgress backend with session ID passed in directly
# and Baes64 encoding

tie %hash, 'Apache::AppSamurai::Tracker', $id, {
   Store     => 'Apache::Session::Store::Postgres',
   Lock      => 'Null',
};

# you decide!

DESCRIPTION

This module is a subclass of Apache::Session that can be used to share non-sensitive information between multiple Apache server processes. Its main use is to provide storage of IP login failures and other non-session data for Apache::AppSamurai.

The normal Apache::Session Generate option is not used. Each tracker uses a set session ID. For instance, "IPFailures" is used for the IP failure tracking feature in Apache::AppSamurai.

The Apache::Session Serialize type is hard set to Base64. This allows for storage in files or inside a database.

The Store and Lock options are still used and relevant, as are any configuration options for the specific sub-modules that are used.

USAGE

You pass the modules you want to use as arguments to the constructor. For normal Apache::Session sub modules, the Apache::Session::Whatever part is appended for you: you should not supply it. (Apache::AppSamurai::Tracker supports the same extended module syntax as Apache::AppSamurai::Session, though in most cases, the standard Apache::Sesssion types should suffice.)

For example, if you wanted to use MySQL as the backing store, you should give the argument Store = 'MySQL'>, and not Store = 'Apache::Session::Store::MySQL'>. There are two modules that you need to specify. Store is the backing store to use. Lock is the locking scheme.

There are many modules included in the Apache::Session distribution that can be used directly with this module.

Please see Apache::Session for more information.

SEE ALSO

Apache::AppSamurai, Apache::AppSamurai::Session, Apache::Session

AUTHOR

Paul M. Hirsch, <paul at voltagenoir.org>

BUGS

See Apache::AppSamurai for information on bug submission and tracking.

SUPPORT

See Apache::AppSamurai for support information.

ACKNOWLEDGEMENTS

This module is based partially on code written by Jeffrey William Baker <jwbaker@acm.org> and the Apache::Session authors.

COPYRIGHT & LICENSE

Copyright 2008 Paul M. Hirsch, all rights reserved.

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.