/ 
Mojolicious-9.42
River stage four • 1019 direct dependents • 1130 total dependents
⭐ Starred 2674 GitHub stars
/ Mojo::Server
Security Advisories (2)
CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user's session.

CVE-2024-58135 (2025-05-03)

Mojolicious versions from 7.28 for Perl may generate weak HMAC session secrets. When creating a default app with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.

NAME

Mojo::Server - HTTP/WebSocket server base class

SYNOPSIS

package Mojo::Server::MyServer;
use Mojo::Base 'Mojo::Server', -signatures;

sub run ($self) {

  # Get a transaction
  my $tx = $self->build_tx;

  # Emit "request" event
  $self->emit(request => $tx);
}

DESCRIPTION

Mojo::Server is an abstract base class for HTTP/WebSocket servers and server interfaces, like Mojo::Server::CGI, Mojo::Server::Daemon, Mojo::Server::Hypnotoad, Mojo::Server::Morbo, Mojo::Server::Prefork and Mojo::Server::PSGI.

EVENTS

Mojo::Server inherits all events from Mojo::EventEmitter and can emit the following new ones.

request

$server->on(request => sub ($server, $tx) {...});

Emitted when a request is ready and needs to be handled.

$server->on(request => sub ($server, $tx) {
  $tx->res->code(200);
  $tx->res->headers->content_type('text/plain');
  $tx->res->body('Hello World!');
  $tx->resume;
});

ATTRIBUTES

Mojo::Server implements the following attributes.

app

my $app = $server->app;
$server = $server->app(MojoSubclass->new);

Application this server handles, defaults to a Mojo::HelloWorld object.

reverse_proxy

my $bool = $server->reverse_proxy;
$server  = $server->reverse_proxy($bool);

This server operates behind a reverse proxy, defaults to the value of the MOJO_REVERSE_PROXY environment variable or true if "trusted_proxies" is not empty.

trusted_proxies

my $proxies = $server->trusted_proxies;
$server     = $server->trusted_proxies(['10.0.0.0/8', '127.0.0.1', '172.16.0.0/12', '192.168.0.0/16', 'fc00::/7']);

This server expects requests from trusted reverse proxies, defaults to the value of the MOJO_TRUSTED_PROXIES environment variable split on commas with optional whitespace. These proxies should be addresses or networks in CIDR form.

METHODS

Mojo::Server inherits all methods from Mojo::EventEmitter and implements the following new ones.

build_app

my $app = $server->build_app('MyApp');
my $app = $server->build_app('MyApp', log => Mojo::Log->new);
my $app = $server->build_app('MyApp', {log => Mojo::Log->new});

Build application from class and assign it to "app".

build_tx

my $tx = $server->build_tx;

Let application build a transaction.

daemonize

$server->daemonize;

Daemonize server process.

load_app

my $app = $server->load_app('/home/sri/myapp.pl');
my $app = $server->load_app('/home/sri/myapp.pl', log => Mojo::Log->new);
my $app = $server->load_app('/home/sri/myapp.pl', {log => Mojo::Log->new});

Load application from script and assign it to "app".

say Mojo::Server->new->load_app('./myapp.pl')->home;

new

my $server = Mojo::Server->new;
my $server = Mojo::Server->new(reverse_proxy => 1);
my $server = Mojo::Server->new({reverse_proxy => 1});

Construct a new Mojo::Server object and subscribe to "request" event with default request handling.

run

$server->run;

Run server. Meant to be overloaded in a subclass.

SEE ALSO

Mojolicious, Mojolicious::Guides, https://mojolicious.org.