/ 
Ado-0.39
/ Ado::Sessions
Security Advisories (1)
CVE-2026-5083 (2026-04-08)

Ado::Sessions versions through 0.935 for Perl generates insecure session ids. The session id is generated from a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. Note that Ado is no longer maintained, and has been removed from the CPAN index. It is still available on BackPAN.

NAME

Ado::Sessions - A factory for HTTP Sessions in Ado

DESCRIPTION

Ado::Sessions chooses the desired type of session storage and loads it.

SYNOPSIS

#in ado.conf
session => {
  type => 'database',
  options => {
      cookie_name        => 'ado',
      default_expiration => 86400,
  }         
}

#In Ado.pm:
has sessions => sub { Ado::Sessions::get_instance(shift->config) };

Cookie domain accessor

Cookie name accessor

Cookie path accessor

default_expiration

Cookie default expiration accessor

generate_id

Session id generator

get_instance

Factory method for creating Ado session instance

prepare_load

Shares common logic which is compatible with Mojolicious::Sessions. The storage implementation class should call this method after it loads the session from the respective storage.

$self->prepare_load($c, $session);

secure

Cookie is secure, flag

prepare_store

Shares common logic which is compatible with Mojolicious::Sessions. The storage implementation class should call this method before it stores the session to the the respective storage. Returns the session id and the session ready to be serialized and base 64 encoded.

my ($id, $session) = $self->prepare_store($c);

session_id

Retrieves the session id from a parameter or cookie defaulting to cookie_name. The cookie_name can be set in ado.conf section session.

my $id = $self->session_id($c);

SEE ALSO

Mojolicious::Sessions, Ado::Sessions::File, Ado::Sessions::Database, Using CORS