/ 
Mojolicious-Plugin-SessionStore-0.05
⭐ Starred 2 / Mojolicious::Sessions::Storable
Security Advisories (1)
CVE-2026-9692 (2026-06-18)

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, the heap address of an anonymous hash, and the PID. These are predictable or low-entropy sources that are unsuitable for security purposes.

NAME

Mojolicious::Sessions::Storable - Storable session manager for Mojolicious

SYNOPSIS

use Mojolicious::Lite;
use Mojolicious::Sessions::Storable;

use Plack::Session::Store::File;

my $sessions = Mojolicious::Sessions::Storable->new(
    session_store => Plack::Session::Store::File->new
);

app->sessions($sessions);

DESCRIPTION

Mojolicious::Sessions::Storable is a storable session manager for Mojolicious.

OPTIONS

Mojolicious::Sessions::Storable inherits all options from Mojolicious::Sessions and supports the following new ones.

session_store

This is expected to be an instance of Plack::Session::Store or an object that implements the same interface. If no option is provided the default Mojolicious::Sessions will be used.

sid_generator

This is a CODE ref use to generate unique session ids. by default it will generate a SHA1 using fairly sufficient entropy.

METHODS

Mojolicious::Sessions::Storable inherits all methods from Mojolicious::Sessions.

AUTHOR

hayajo <hayajo@cpan.org>

COPYRIGHT

Copyright 2013- hayajo

LICENSE

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

SEE ALSO

Mojolicious, Mojolicious::Sessions, Mojolicious::Plugin::SessionStore, Plack::Middleware::Session