/ 
Amon2-3.04
⭐ Starred 163 / Amon2
Security Advisories (1)
CVE-2025-15604 (2026-03-28)

Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions. In versions 6.06 through 6.16, the random_string function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes by concatenating a SHA-1 hash seeded with the built-in rand() function, the PID, and the high resolution epoch time. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Before version 6.06, there was no fallback when /dev/urandom was not available. Before version 6.04, the random_string function used the built-in rand() function to generate a mixed-case alphanumeric string. This function may be used for generating session ids, generating secrets for signing or encrypting cookie session data and generating tokens used for Cross Site Request Forgery (CSRF) protection.

NAME

Amon2 - lightweight web application framework

SYNOPSIS

package MyApp;
use parent qw/Amon2/;
use Amon2::Config::Simple;
sub load_config { Amon2::Config::Simple->load(shift) }

DESCRIPTION

Amon2 is simple, readable, extensible, STABLE, FAST web application framework based on Plack.

METHODS

CLASS METHODS for <Amon2> class

my $c = Amon2->context();

Get the context object.

Amon2->set_context($c)

Set your context object(INTERNAL USE ONLY).

CLASS METHODS for inherited class

MyApp->config()

This method returns configuration information. It is generated by MyApp->load_config.

MyApp->mode_name()

This is a mode name for Amon2. Default implementation of this method is:

sub mode_name { $ENV{PLACK_ENV} }

You can override this method if you want to determine the mode by other method.

MyApp->new()

Create new context object.

MyApp->bootstrap()

Create new context object and set it to global context.

MyApp->base_dir()

This method returns application base directory.

MyApp->load_plugin($module_name[, \%config])

This method loads plugin for the application.

$module_name: package name of the plugin. You can write it as two form like DBIx::Class:

__PACKAGE__->load_plugin("Web::HTTPSession");    # => loads Amon2::Plugin::Web::HTTPSession

If you want to load a plugin in your own name space, use '+' character before package name like following: __PACKAGE__->load_plugin("+MyApp::Plugin::Foo"); # => loads MyApp::Plugin::Foo

MyApp->load_plugins($module_name[, \%config ], ...)

Load multiple plugins at one time. The arguments are processed by Data::OptList.

If you want to load a plugin in your own name space, use '+' character before package name like following:

__PACKAGE__->load_plugins("+MyApp::Plugin::Foo"); # => loads MyApp::Plugin::Foo
MyApp->load_config()

You can get a configuration hashref from config/$ENV{PLACK_ENV}.pl. You can override this method for customizing configuration loading method.

MyApp->add_config()

DEPRECATED.

DOCUMENTS

More complicated documents are available on http://amon.64p.org/

SUPPORTS

#amon at irc.perl.org is available.

AUTHOR

Tokuhiro Matsuno

LICENSE

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.