/ 
Dancer2-1.1.2
⭐ Starred 552 / Dancer2::Manual::Testing
Security Advisories (1)
CVE-2026-13577 (2026-07-20)

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

NAME

Dancer2::Manual::Testing - Writing tests for Dancer2

VERSION

version 1.1.2

Basic application testing

Since Dancer2 produces PSGI applications, you can easily write tests using Plack::Test and provide your Dancer application as the app for testing.

A basic test (which we also scaffold with dancer2) looks like this:

use strict;
use warnings;

use Test::More tests => 4;
use Plack::Test;
use HTTP::Request::Common;

use_ok('MyApp');

# create an application
my $app = MyApp->to_app;
isa_ok( $app, 'CODE' );

# create a testing object
my $test = Plack::Test->create($app);

# now you can call requests on it and get responses
# requests are of HTTP::Request
# responses are of HTTP::Response

# "GET" from HTTP::Request::Common creates an HTTP::Request object
my $response = $test->request( GET '/' );

# same as:
# my $response = $test->request( HTTP::Request->new( GET => '/' ) );

ok( $response->is_success, 'Successful request' );
is( $response->content, 'OK', 'Correct response content' );

Read the documentation for HTTP::Request and HTTP::Request::Common to see the different options for sending parameters.

Cookies

If you don't want to use an entire user agent for this test, you can use HTTP::Cookies to store cookies and then retrieve them:

use strict;
use warnings;

use Test::More tests => 3;
use Plack::Test;
use HTTP::Request::Common;
use HTTP::Cookies;

use_ok('MyApp');

my $url  = 'http://localhost';
my $jar  = HTTP::Cookies->new();
my $test = Plack::Test->create( MyApp->to_app );

subtest 'Create session' => sub {
    my $res = $test->request( GET "$url/login" );
    ok( $res->is_success, 'Successful login' );

    # extract cookies from the response and store in the jar
    $jar->extract_cookies($res);
};

subtest 'Check session' => sub {
    my $req = GET "$url/logout";

    # add cookies to the request
    $jar->add_cookie_header($req);

    my $res = $test->request($req);
    ok( $res->is_success, 'Successful logout' );
    like(
        $res->content,
        'Successfully logged out',
        'Got correct log out content',
    );
};

Please note that the request URL must include scheme and host for the call to "add_cookie_header" in HTTP::Cookies to work.

Plugins

In order to test plugins, you can create an application on the spot, as part of the test script code, and use the plugin there.

use strict;
use warnings;

use Test::More tests => 2;
use Plack::Test;
use HTTP::Request::Common;

{
    package MyTestApp;
    use Dancer2;
    use Dancer2::Plugin::MyPlugin;

    get '/' => sub { my_keyword };
}

my $test = Plack::Test->create( MyTestApp->to_app );
my $res  = $test->request( GET '/' );

ok( $res->is_success, 'Successful request' );
is( $res->content, 'MyPlugin-MyKeyword', 'Correct content' );

AUTHOR

Dancer Core Developers

COPYRIGHT AND LICENSE

This software is copyright (c) 2024 by Alexis Sukrieh.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.