NAME

YATT::Lite::WebMVC0::Partial::Session2 -- (Revised) Session support for YL

SYNOPSIS

In app.psgi:

use YATT::Lite::WebMVC0::SiteApp -as_base; # As usual.
#
# Below imports definitions of &yatt:session_start(); and
# session_state/session_store options with multiple inheritance.
#
use YATT::Lite::WebMVC0::Partial::Session2 -as_base;
#
# Then create site app as usual.
#
use Plack::Session::State::Cookie ();
use Plack::Session::Store::DBI ();
#
my MY $site = MY->load_factory_for_psgi(
  $0,
  doc_root => "$FindBin::Bin/public",

  session_state => Plack::Session::State::Cookie->new(),
  session_store => [DBI => get_dbh => sub { DBI->connect(...) } ],
);
#
return $site->to_app;

In *.yatt:

&yatt:session_start(); # Optional

<h2>Hello &yatt:psgix_session(){user};</h2>

DESCRIPTION

This module is a session plugin for site apps of YATT::Lite, based on Plack::Session family.

Internally, it creates Plack::Middleware::Session at startup. Then it emulates Plack::Middleware::Session#get_session on each call to &yatt:session_start(); and emulates Plack::Middleware::Session#finalize on response finalization.

OPTIONS

Following options are imported to the site app.

session_state = Plack::Session::State::Cookie | [$NAME => @ARGS]

This option can take one value of following two types:

An instance of Plack::Session::State::Cookie compatible object.

An ARRAY which consists of [$NAME, @ARGS]

In this case, $NAME is used to load specific session state class using Plack::Util::load_class($NAME, 'Plack::Session::State').

If no option is provided the default Plack::Session::State::Cookie will be used.

Session cookie attributes

Whatever state object is used, the session cookie is sent with these attributes unless the state object (or psgix.session.options) already defines them:

Secure

Set whenever the request came over TLS: psgi.url_scheme is https, or X-Forwarded-Proto: https from a TLS-terminating proxy, or the CGI-style HTTPS variable is set.

HttpOnly

Always, so the session id is not readable from document.cookie.

SameSite=Lax

Always.

To change them, pass an explicitly configured state object:

session_state => Plack::Session::State::Cookie->new(
  httponly => 1, samesite => 'Strict', secure => 1,
),

Session id validation

The id taken from the request cookie is checked with the state's validate_session_id (/\A[0-9a-f]{40}\Z/ for the Plack default) before it is handed to the store. A cookie that does not pass is treated as if there were no cookie, so a crafted value never reaches $store->fetch or $store->remove (which, with Plack::Session::Store::File, is a file path).

session_store = Plack::Session::Store | [$NAME => @ARGS]

This option can take one value of following two types:

An instance of Plack::Session::Store compatible object.

An ARRAY which consists of [$NAME, @ARGS]

In this case, $NAME is used to load specific session state class using Plack::Util::load_class($NAME, 'Plack::Session::Store').

If no option is provided the default Plack::Session::Store will be used.

session_middleware_class = $CLASS_NAME

ENTITY FUNCTIONS

session_start

Explicitly start session. psgix_session calls this automatically.

session_state_id

Extract state id from cookie without starting session. Returns undef if not exists.

session_state_exists

Test if session state id exists.

Raw psgix.session interface

psgix_session

$env->{psgix.session}

psgix_session_options

$env->{psgix.session.options}

psgix_session_exists

$env->{psgix.session.options}{id}

plack.session (Plack::Session) interface

session

$env->{plack.session}

session_id

Plack::Session->id()

session_get

Plack::Session->get()

session_set

Plack::Session->set()

session_remove

Plack::Session->remove()

session_keys

Plack::Session->keys()

session_expire

Plack::Session->expire()

SEE ALSO

Plack::Session::State::Cookie, Plack::Session::Store

AUTHOR

hkoba

cpanm YATT::Lite

perl -MCPAN -e shell
install YATT::Lite