Controlling Session expire time
When I use Dancer::Session::YAML to create a session, the session cookie is set to expire when the browser closes. Is there a way for me to set an expire time for the session cookie? I looked in Dancer::Session, Dancer::Session::YAML, Dancer::Cookbook, and Dancer::Session::Abstract but didn't see anything (maybe I missed it). Thanks, Brian
Hmm, I dug into the actual code and found this in Dancer::Session::Abstract: if (my $expires = setting('session_expires')) { $cookie{expires} = Dancer::Cookie::_epoch_to_gmtstring(time + $expires); } It appears I can have a global timeout option in the settings. This is useful although I think I need something a bit more flexible. I need to be able to choose a session time out based on user input. For example, if they check "remember me" I want the session to expire in 2 weeks, otherwise just use a session cookie. The write_session_id method is specifically mentioned as something I should not attempt to overload. Does anyone have any ideas about how I can have a dynamic session timeout? Thanks again, Brian On Mon, Mar 14, 2011 at 4:27 PM, Brian E. Lozier <brian@massassi.com> wrote:
When I use Dancer::Session::YAML to create a session, the session cookie is set to expire when the browser closes. Is there a way for me to set an expire time for the session cookie? I looked in Dancer::Session, Dancer::Session::YAML, Dancer::Cookbook, and Dancer::Session::Abstract but didn't see anything (maybe I missed it).
Thanks, Brian
Hello, my idea is make to Dancer::Sesion similary to CGI::Session. Dancer Session has some potencional problems and i think Session must be rewriting to better using. 1) In sub write in Session.pm can rewrite ID. If you put something like 'session id => xxx' than now session id has name 'xxx'. I think programs can't change this ID name. 2) In every called session method than this method initialize and read and next write to session file. I think that session must be only read before 'sub before' and save after 'sub after'. Not every called 'session' 3) Session expiring in cookie is bad idea. Expiring in cokie must be set, but we never trust to client side. We must save expiring time to session and check this on server side. I make simply patch for latest git version 1.3019_02 with this changes with documentation and test how can be used.
------------ Původní zpráva ------------ Od: Brian E. Lozier <brian@massassi.com> Předmět: Re: [Dancer-users] Controlling Session expire time Datum: 15.3.2011 00:34:35 ---------------------------------------- Hmm, I dug into the actual code and found this in Dancer::Session::Abstract:
if (my $expires = setting('session_expires')) { $cookie{expires} = Dancer::Cookie::_epoch_to_gmtstring(time + $expires); }
It appears I can have a global timeout option in the settings. This is useful although I think I need something a bit more flexible. I need to be able to choose a session time out based on user input. For example, if they check "remember me" I want the session to expire in 2 weeks, otherwise just use a session cookie.
The write_session_id method is specifically mentioned as something I should not attempt to overload. Does anyone have any ideas about how I can have a dynamic session timeout?
Thanks again, Brian
On Mon, Mar 14, 2011 at 4:27 PM, Brian E. Lozier <brian@massassi.com> wrote:
When I use Dancer::Session::YAML to create a session, the session cookie is set to expire when the browser closes. Is there a way for me to set an expire time for the session cookie? I looked in Dancer::Session, Dancer::Session::YAML, Dancer::Cookbook, and Dancer::Session::Abstract but didn't see anything (maybe I missed it).
Thanks, Brian
_______________________________________________ Dancer-users mailing list Dancer-users@perldancer.org http://www.backup-manager.org/cgi-bin/listinfo/dancer-users
Hello Igor, I was wondering if you were able to get this patch accepted into Dancer, and if not, what I might do to help? I really need to be able to set session cookie expire times dynamically as the users of my app should be able to check a "keep me logged in" box which requires me to be able to dynamically set the session cookie client timeout. I can manage expiring sessions on the server. Anyone else working with Dancer apps, do you have some other method of allowing a user to stay logged in for a longer amount of time than usual by checking a "remember me" or "keep me logged in" box? Thanks, Brian 2011/3/20 <igor.bujna@post.cz>:
Hello, my idea is make to Dancer::Sesion similary to CGI::Session. Dancer Session has some potencional problems and i think Session must be rewriting to better using. 1) In sub write in Session.pm can rewrite ID. If you put something like 'session id => xxx' than now session id has name 'xxx'. I think programs can't change this ID name. 2) In every called session method than this method initialize and read and next write to session file. I think that session must be only read before 'sub before' and save after 'sub after'. Not every called 'session' 3) Session expiring in cookie is bad idea. Expiring in cokie must be set, but we never trust to client side. We must save expiring time to session and check this on server side.
I make simply patch for latest git version 1.3019_02 with this changes with documentation and test how can be used.
------------ Původní zpráva ------------ Od: Brian E. Lozier <brian@massassi.com> Předmět: Re: [Dancer-users] Controlling Session expire time Datum: 15.3.2011 00:34:35 ---------------------------------------- Hmm, I dug into the actual code and found this in Dancer::Session::Abstract:
if (my $expires = setting('session_expires')) { $cookie{expires} = Dancer::Cookie::_epoch_to_gmtstring(time + $expires); }
It appears I can have a global timeout option in the settings. This is useful although I think I need something a bit more flexible. I need to be able to choose a session time out based on user input. For example, if they check "remember me" I want the session to expire in 2 weeks, otherwise just use a session cookie.
The write_session_id method is specifically mentioned as something I should not attempt to overload. Does anyone have any ideas about how I can have a dynamic session timeout?
Thanks again, Brian
On Mon, Mar 14, 2011 at 4:27 PM, Brian E. Lozier <brian@massassi.com> wrote:
When I use Dancer::Session::YAML to create a session, the session cookie is set to expire when the browser closes. Is there a way for me to set an expire time for the session cookie? I looked in Dancer::Session, Dancer::Session::YAML, Dancer::Cookbook, and Dancer::Session::Abstract but didn't see anything (maybe I missed it).
Thanks, Brian
_______________________________________________ Dancer-users mailing list Dancer-users@perldancer.org http://www.backup-manager.org/cgi-bin/listinfo/dancer-users
_______________________________________________ Dancer-users mailing list Dancer-users@perldancer.org http://www.backup-manager.org/cgi-bin/listinfo/dancer-users
Hello, i make this simply patch to show how can be implemented session expiring. I think, session expiring should be standart in Dancer. I use patch in my pages. Now it's only to make same changes to putted dancer, like clear read|write sesson in before|after subs. Or nicely session init and finish remote_addr subs in session and than can be this patch putted to dancer. And last is how to putted expiring time to session via session_expire() sub or session->('name')->{'expire')->{'time').
------------ Původní zpráva ------------ Od: Brian E. Lozier <brian@massassi.com> Předmět: Re: [Dancer-users] Controlling Session expire time Datum: 12.4.2011 16:37:01 ---------------------------------------- Hello Igor,
I was wondering if you were able to get this patch accepted into Dancer, and if not, what I might do to help? I really need to be able to set session cookie expire times dynamically as the users of my app should be able to check a "keep me logged in" box which requires me to be able to dynamically set the session cookie client timeout. I can manage expiring sessions on the server.
Anyone else working with Dancer apps, do you have some other method of allowing a user to stay logged in for a longer amount of time than usual by checking a "remember me" or "keep me logged in" box?
Thanks, Brian
2011/3/20 <igor.bujna@post.cz>:
Hello, my idea is make to Dancer::Sesion similary to CGI::Session. Dancer Session has some potencional problems and i think Session must be rewriting to better using. 1) In sub write in Session.pm can rewrite ID. If you put something like 'session id => xxx' than now session id has name 'xxx'. I think programs can't change this ID name. 2) In every called session method than this method initialize and read and next write to session file. I think that session must be only read before 'sub before' and save after 'sub after'. Not every called 'session' 3) Session expiring in cookie is bad idea. Expiring in cokie must be set, but we never trust to client side. We must save expiring time to session and check this on server side.
I make simply patch for latest git version 1.3019_02 with this changes with documentation and test how can be used.
------------ Původní zpráva ------------ Od: Brian E. Lozier <brian@massassi.com> Předmět: Re: [Dancer-users] Controlling Session expire time Datum: 15.3.2011 00:34:35 ---------------------------------------- Hmm, I dug into the actual code and found this in Dancer::Session::Abstract:
if (my $expires = setting('session_expires')) { $cookie{expires} = Dancer::Cookie::_epoch_to_gmtstring(time + $expires); }
It appears I can have a global timeout option in the settings. This is useful although I think I need something a bit more flexible. I need to be able to choose a session time out based on user input. For example, if they check "remember me" I want the session to expire in 2 weeks, otherwise just use a session cookie.
The write_session_id method is specifically mentioned as something I should not attempt to overload. Does anyone have any ideas about how I can have a dynamic session timeout?
Thanks again, Brian
On Mon, Mar 14, 2011 at 4:27 PM, Brian E. Lozier <brian@massassi.com> wrote:
When I use Dancer::Session::YAML to create a session, the session cookie is set to expire when the browser closes. Is there a way for me to set an expire time for the session cookie? I looked in Dancer::Session, Dancer::Session::YAML, Dancer::Cookbook, and Dancer::Session::Abstract but didn't see anything (maybe I missed it).
Thanks, Brian
_______________________________________________ Dancer-users mailing list Dancer-users@perldancer.org http://www.backup-manager.org/cgi-bin/listinfo/dancer-users
_______________________________________________ Dancer-users mailing list Dancer-users@perldancer.org http://www.backup-manager.org/cgi-bin/listinfo/dancer-users
I see space for a plugin here. Unless I'm overlooking something, you need a way to temporarily set a configuration option and have it removed at the end of the request: # ... in your code volatile session_expires => '...'; # whatever the business logic dictates # ... in the plugin, proof of concept my %original_for; register volatile => sub { my ($name, $value) = @_; my $config = config(); if (! exists $original_for{$name}) { $original_for{$name} = exists($config->{$name}) ? [ $config->{$name} ] : undef; } set $name, $value; }; after sub { # restore original values my $config = config(); while (my ($name, $value) = each %original_for) { delete $config->{$name}; $config->{$name} = $value->[0] if ref $value; } %original_for = (); }; Of course the restoration mechanism above somewhat breaks encapsulation for config/set/setting. Could we possibly use only Dancer::Config::setting? The tricky part is handling the "no previous value for this configuration" case. And of course this does not play well with threads (but I wonder if Dancer plays nice with them at all). Cheers, Flavio. On Tue, Mar 15, 2011 at 12:34 AM, Brian E. Lozier <brian@massassi.com>wrote:
Hmm, I dug into the actual code and found this in Dancer::Session::Abstract:
if (my $expires = setting('session_expires')) { $cookie{expires} = Dancer::Cookie::_epoch_to_gmtstring(time + $expires); }
It appears I can have a global timeout option in the settings. This is useful although I think I need something a bit more flexible. I need to be able to choose a session time out based on user input. For example, if they check "remember me" I want the session to expire in 2 weeks, otherwise just use a session cookie.
The write_session_id method is specifically mentioned as something I should not attempt to overload. Does anyone have any ideas about how I can have a dynamic session timeout?
Thanks again, Brian
On Mon, Mar 14, 2011 at 4:27 PM, Brian E. Lozier <brian@massassi.com> wrote:
When I use Dancer::Session::YAML to create a session, the session cookie is set to expire when the browser closes. Is there a way for me to set an expire time for the session cookie? I looked in Dancer::Session, Dancer::Session::YAML, Dancer::Cookbook, and Dancer::Session::Abstract but didn't see anything (maybe I missed it).
Thanks, Brian
_______________________________________________ Dancer-users mailing list Dancer-users@perldancer.org http://www.backup-manager.org/cgi-bin/listinfo/dancer-users
participants (3)
-
Brian E. Lozier -
Flavio Poletti -
igor.bujna＠post.cz