/ 
HTTP-Session2-1.03
River stage zero No dependents
⭐ Starred 5 GitHub stars
/ HTTP::Session2::ServerStore
Security Advisories (2)
CVE-2018-25160 (2018-01-26)

HTTP::Session2 1.09 does not validate session id, this causes RCE depending on the session store you use.

CVE-2026-3255 (2026-02-27)

HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand() function. The HTTP::Session2 session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand() function is unsuitable for cryptographic usage. HTTP::Session2 after version 1.02 will attempt to use the /dev/urandom device to generate a session id, but if the device is unavailable (for example, under Windows), then it will revert to the insecure method described above.

NAME

HTTP::Session2::ServerStore - Session store

DESCRIPTION

This module is a part of HTTP::Session2 library. This module saves the session data on server side storage.

CONSTRUCTOR PARAMETERS

store: Object, optional

The storage object. You need to set 'store' or 'get_store'.

get_store : CodeRef, optional

Callback function to get the storage object.

The storage object must have following 3 methods.

$cache->get($key:Str)
$cache->set($key:Str, $value:Serializable)
$cache->remove($key:Str)

And, cache object should be serialize/deserialize the data automatically.

CHI supports all things. You can use any CHI drivers.

But, I recommend to use Cache::Memcached::Fast.

METHODS

Methods are listed on HTTP::Session2::Base.