NAME

Mojolicious::Plugin::Fondation::SessionStore - Fondation plugin — server-side session storage via Mojolicious::Sessions::Store

VERSION

version 0.01

SYNOPSIS

# In myapp.pl or myapp.conf
plugin 'Fondation' => {
    dependencies => [
        'Fondation::SessionStore',
    ],
};

# With custom configuration
plugin 'Fondation' => {
    dependencies => [
        { 'Fondation::SessionStore' => {
            backend   => 'file',
            store_dir => '/var/lib/myapp/sessions',
            session   => {
                cookie_name        => 'myapp',
                default_expiration => 3600,
            },
        }},
    ],
};

DESCRIPTION

Mojolicious::Plugin::Fondation::SessionStore replaces the default signed-cookie session storage with server-side storage via Mojolicious::Sessions::Store.

A signed cookie containing only a session ID is sent to the client; the actual session data lives in a backend (filesystem by default).

The Mojolicious::Controller session helper works unchanged.

NAME

Mojolicious::Plugin::Fondation::SessionStore - Server-side session storage for Fondation

WHY SERVER-SIDE STORAGE?

By default, Mojolicious stores session data directly in a signed cookie. The cookie is the session — serialized, signed, but still readable by the client (base64-encoded, not encrypted). This plugin opts for server-side storage instead, for three key reasons:

• Security

  Only an opaque session ID is sent to the browser. The actual session data (user ID, roles, permissions, etc.) never leaves the server.

• Revocation

  Sessions can be destroyed server-side at any time — useful for forced logout, password resets, or banning users. With cookie-only sessions, the cookie remains valid until it expires, regardless of server intent.

• Size

  Cookies are limited to roughly 4 KB. Server-side sessions have no such constraint, allowing larger payloads when needed.

CONFIGURATION

All keys are optional and can be overridden in myapp.pl or myapp.conf.

• backend

  Backend name (file) or a backend instance (for testing). Default: file.

• store_dir

  Directory for session files when using the file backend. Default: $app->home/data/sessions.

• session

  Hashref of session options passed to Mojolicious::Sessions::Store:

  • cookie_name

    Session cookie name. Default: fondation.

  • default_expiration

    Session lifetime in seconds. Default: 1800 (30 minutes).

BACKENDS

• file

  Mojolicious::Sessions::Store::Backend::File — JSON files on disk.

Future: redis, dbi.

DEPENDENCIES

Mojolicious::Sessions::Store (standalone, no Fondation dependency).

SEE ALSO

Mojolicious::Sessions::Store, Mojolicious::Sessions::Store::Backend::File, Mojolicious::Plugin::Fondation

AUTHOR

Daniel Brosseau dab@cpan.org

COPYRIGHT AND LICENSE

This software is copyright (c) 2026 by Daniel Brosseau.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.