/ 
Catalyst-Plugin-Authentication-0.03
/ Catalyst::Plugin::Authentication::Store::Minimal
Security Advisories (2)
CVE-2026-5091 (2026-05-21)

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.

CVE-2009-10007 (2026-06-09)

Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can use this to impersonate the victim.

NAME

Catalyst::Plugin::Authentication::Store::Minimal - Authentication database in $c->config.

SYNOPSIS

use Catalyst qw/
  Authentication
  Authentication::Store::Minimal
  Authentication::Credential::Password
  /;

__PACKAGE__->config->{authentication}{users} = {
    name => {
        password => "s3cr3t",
        roles    => [qw/admin editor/],
        ...
    },
};

sub login : Global {
    my ( $self, $c ) = @_;

    $c->login( $c->req->param("login"), $c->req->param("password"), );
}

DESCRIPTION

This authentication store plugin lets you create a very quick and dirty user database in your application's config hash.

You will need to include the Authentication plugin, and at least one Credential plugin to use this Store. Credential::Password is reccommended.

It's purpose is mainly for testing, and it should probably be replaced by a more "serious" store for production.

The hash in the config, as well as the user objects/hashes are freely mutable at runtime.

CONFIGURATION

users

This is a simple hash of users, the keys are the usenames, and the values are hashrefs containing a password key/value pair, and optionally, a roles/list of role-names pair. If using roles, you will also need to add the Authorization::Roles plugin.

See the SYNOPSIS for an example.

INTERNAL METHODS

setup

This method will popultate $c->config->{authentication}{store} so that "default_auth_store" in Catalyst::Plugin::Authentication can use it.