/ 
Dancer-Plugin-SecureSessionID-0.01
River stage zero No dependents
/ Dancer::Plugin::SecureSessionID

NAME

Dancer::Plugin::SecureSessionID - Dancer-Plugin-SecureSessionID

VERSION

Version 0.01

SYNOPSIS

use Dancer::Plugin::SecureSessionID;

use_secure_session_id;

DESCRIPTION

This plugin overrides the build_id() method in Dancer::Session::Abstract and make use of Crypt::Random to get really secure random session ids.

METHODS

use_secure_session_id([ %options ])

The options are passed into makerandom_octet(...), so any option described in Crypt::Random are valid here. The defaults are Strength=1 and Length=16. These options can be set with plugin settings, too.

use_secure_session_id(Length => 20, Uniform => 1, Skip => 512);

same as:

plugins:
  SecureSessionID:
    Length: 20
    Uniform: 1
    Skip: 512

The result is encoded with base64url(). A length of 16 random bytes results in 22 characters.

SECURITY WARNING

Any session module which does not override build_id() make profit from this plugin. This behaviour may change in future. Don't rely on it without auditing the source code of the affected session modules. By now, both the Simple and YAML session engines (shipped with the Dancer package) do not override build_id so this plugin works as expected.

Addtionally, mind the section about blocking behaviour in the documentation of Crypt::Random. If you app blocks, you can set the Strength option to 0. This may be a lack of security but it helps to improve performance. Since your app cause network traffic, the entropy pool will be recharched often enough to never get blocked. See also the manpage of your random device.

AUTHOR

David Zurborg, <zurborg@cpan.org>

BUGS

Please report any bugs or feature requests trough my project management tool at http://development.david-zurb.org/projects/libdancer-plugin-securesessionid/issues/new. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes.

SUPPORT

You can find documentation for this module with the perldoc command.

perldoc Dancer::Plugin::SecureSessionID

You can also look for information at:

COPYRIGHT & LICENSE

Copyright 2014 David Zurborg, all rights reserved.

This program is released under the following license: open-source