/ 
HTTP-Session2-1.04
River stage zero No dependents
⭐ Starred 5 GitHub stars
/ HTTP::Session2::ClientStore2
Security Advisories (2)
CVE-2018-25160 (2018-01-26)

HTTP::Session2 1.09 does not validate session id, this causes RCE depending on the session store you use.

CVE-2026-3255 (2026-02-27)

HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand() function. The HTTP::Session2 session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand() function is unsuitable for cryptographic usage. HTTP::Session2 after version 1.02 will attempt to use the /dev/urandom device to generate a session id, but if the device is unavailable (for example, under Windows), then it will revert to the insecure method described above.

NAME

HTTP::Session2::ClientStore2 - Client store

DESCRIPTION

This is a part of HTTP::Session2 library.

This module stores the data to the cookie value with encryption.

Normally, you should use HTTP::Session2::ServerStore.

ClientStore specific constructor parameters

serializer: CodeRef

Serializer callback function.

Default: MIME::Base64::encode(Storable::nfreeze($_[0]), '' )

deserializer: CodeRef

Deserializer callback function.

Default: Storable::thaw(MIME::Base64::decode($_[0]))

ignore_old: Int

Ignore session data older than ignore_old value. You can specify this value in epoch time.

cipher: Crypt::CBC : Required

Cipher for the session data.