Changes for version 1.100 - 2026-08-06
- UPGRADE WARNING: the on-the-wire token format has changed and tokens issued by 1.001 or earlier are rejected. Any page already rendered by the old version stops validating the moment this is deployed, so users part way through a form will get a 403 and have to reload. Drain or expire sessions as part of the upgrade if that matters to you.
- Security: mask each CSRF token with fresh randomness before returning it to the caller, preventing a stable token representation from being recovered through a BREACH compression oracle. Reported by dcook on irc.perl.org; the same issue Mojolicious addressed in GHSA-cf46-h6jw-mj3r.
- Stop logging submitted and expected CSRF token values in debug mode.
- Documentation fix: the overridable failure hook is 'delegate_failed_csrf_token_check'. Earlier docs named a 'csrf_failure_response' method that never existed, so overrides written against the documented name were silently ignored.
- Documentation fix: the attribute that skips automatic checks is 'DisableCSRF', not 'NoCSRF' as the prose claimed.
- Dropped the unused Bytes::Random::Secure prerequisite and raised the MIME::Base64 floor to 3.11, the first release with encode_base64url.
Modules
Robust CSRF protection plugin for Catalyst