/ 
Dancer-1.122
/ Dancer::Session::Cookie
Security Advisories (3)
CVE-2026-5080 (2026-04-30)

Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely. The session id is generated from summing the character codepoints of the absolute pathname with the process id, the epoch time and calls to the built-in rand() function to return a number between 0 and 999-billion, and concatenating that result three times. The path name might be known or guessed by an attacker, especially for applications known to be written using Dancer with standard installation locations. The epoch time can be guessed by an attacker, and may be leaked in the HTTP header. The process id comes from a small set of numbers, and workers may have sequential process ids. The built-in rand() function is seeded with 32-bits and is considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

CVE-2012-5572 (2014-05-30)

CRLF injection vulnerability in the cookie method allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name.

CVE-2011-1589 (2011-04-05)

Directory traversal vulnerability (Mojolicious report, but Dancer was vulnerable as well).

NAME

Dancer::Session::Cookie - Encrypted cookie-based session backend for Dancer

DESCRIPTION

This module implements a session engine for sessions stored entirely inside cookies. Usually only session id is stored in cookies and the session data itself is saved in some external storage like database. This module allows us to avoid using external storage at all.

Since we cannot trust any data provided by client in cookies, we use cryptography to ensure secrecy and integrity.

CONFIGURATION

The setting session should be set to cookie in order to use this session engine in a Dancer application.

A mandatory setting is needed as well: session_cookie_key, which should contain a random string of at least 16 characters (shorter keys are not cryptographically strong using AES in CBC mode).

Here is an example configuration that uses this session engine:

session: "cookie"
session_cookie_key: "kjsdf07234hjf0sdkflj12*&(@*jk"

DEPENDENCY

This module depends on Crypt::CBC, Crypt::Rijndael, String::CRC32, Storable and MIME::Base64.

AUTHOR

This module has been written by Alex Kapranoff, see the AUTHORS file for details.

SEE ALSO

See Dancer::Session for details about session usage in route handlers.

COPYRIGHT

This module is copyright (c) 2009 Alex Kapranoff <kappa@cpan.org>.

LICENSE

This module is free software and is released under the same terms as Perl itself.

1 POD Error

The following errors were encountered while parsing the POD:

Around line 118:

Deleting unknown formatting code Q<>