/ 
Apache-AppSamurai-1.01
/ Apache::AppSamurai::Session
Security Advisories (1)
CVE-2026-19565 (2026-08-23)

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running digest, and the process id. CreateSession calls it with an empty key source on every login, and the optional Keysource directive is the only route to the other branch. The result is 64 hex characters. The microsecond field of the first reading takes one of a million values, the later readings follow it within microseconds, and the process id is drawn from a small range. The key is returned to the browser as the session cookie, and is combined with the configured server key to compute the session id and to encrypt the stored session data. An attacker who knows the second in which a session was created and the process id of the worker that created it can enumerate candidate keys and recover the victim's cookie, bypassing authentication for the protected resources. Each candidate has to be tried against the server, which validates the cookie with a key the attacker does not hold.

NAME

Apache::AppSamurai::Session - Apache::AppSamurai wrapper for Apache::Session

SYNOPSIS

use Apache::AppSamurai::Session;

# Equivalent to Apache::Session::Flex use:

tie %hash, 'Apache::AppSamurai::Session', $id, {
   Store     => 'DB_File',
   Lock      => 'Null',
   Generate  => 'MD5',
   Serialize => 'Storable'
};

# Postgress backend with AppSamurai HMAC-SHA265 generator and
# AES (Rijndael) encrypting serializer.

tie %hash, 'Apache::AppSamurai::Session', $id, {
   Store     => 'Postgress',
   Lock      => 'Null',
   Generate  => 'AppSamurai/HMAC_SHA',
   Serialize => 'AppSamurai/CryptBase64'
};

# Wacky setup with imaginary Thinger::Thing::File storage module
# and very real Apache::AppSamurai::Session::Serialize::CryptBase64
# serializer.  (This shows the alternate module syntaxes.)

tie %hash 'Apache::AppSamurai::Session', $id, {
   Store     => 'Thinger::Thing::File',
   Lock      => 'Null',
   Generate  => 'Ranom::Garbage',
   Serialize => 'AppSamurai/CryptBase64'
};

# you decide!

DESCRIPTION

This module is a overload of Apache::Session which allows you to specify the backing store, locking scheme, ID generator, and data serializer at runtime. You do this by passing arguments in the usual Apache::Session style (see SYNOPSIS). You may use any of the modules included in this distribution, or a module of your own making.

In addition to the standard Apache::Session setup, this module allows for using modules from within of the Apache::AppSamurai::Session tree by prefixing with AppSamurai/, or using any visible Perl module by supplying its full module name. (Whatever the module, it still must meet standard Apache::Session interface functionality.)

USAGE

You pass the modules you want to use as arguments to the constructor. There are three ways to point to a module:

1)

Specify the Apache::Session name. For instance, for Apache::Session::Storage::File, you would use:

Store => 'File'
2)

Specify a name under the Apache::AppSamurai::Session tree. For instance, for Apache::AppSamurai::Session::Serialize::CryptBase64, you would use:

Serialize => 'AppSamurai/CryptBase64'
3)

Specify the full Perl module name. For instance, for Junk::Thing::Monster to be the session generator:

Generate => 'Junk::Thing::Monster'

In addition to the arguments needed by this module, you must provide whatever arguments are expected by the backing store and lock manager that you are using. Please see the documentation for those modules, and Apache::Session for more general session storage information.

SEE ALSO

Apache::AppSamurai, Apache::Session

AUTHOR

Paul M. Hirsch, <paul at voltagenoir.org>

BUGS

See Apache::AppSamurai for information on bug submission and tracking.

SUPPORT

See Apache::AppSamurai for support information.

ACKNOWLEDGEMENTS

This module is based partially on code written by Jeffrey William Baker <jwbaker@acm.org> and the Apache::Session authors.

COPYRIGHT & LICENSE

Copyright 2008 Paul M. Hirsch, all rights reserved.

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.