/ 
Mojolicious-9.53
⭐ Starred 2674 / Mojo::Server::Morbo
Security Advisories (1)
CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies.  An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.

NAME

Mojo::Server::Morbo - Tonight at 11...DOOOOOOOOOOOOOOOM!

SYNOPSIS

use Mojo::Server::Morbo;

my $morbo = Mojo::Server::Morbo->new;
$morbo->run('/home/sri/myapp.pl');
$morbo->run('/home/sri/myapp.pl', 'prefork', '-w', 1);

Mojo::Server::Morbo->new(exec => ['npx webpack --watch'])->run('/home/sri/myapp.pl');

DESCRIPTION

Mojo::Server::Morbo is a self-restart capable development server. It starts your application with a server command, like Mojolicious::Command::daemon or Mojolicious::Command::prefork, and restarts it whenever a file changes. Listen sockets are only created once and then passed on to the server, so they should be configured with Morbo and not the server command. Note that the server uses signals for process management, so you should avoid modifying signal handlers in your applications.

Additional commands, like asset bundlers in watch mode, can be started alongside the server with "exec". They only get started once, are not restarted together with the server, and get stopped when Morbo shuts down.

To start applications with it you can use the morbo script.

$ morbo ./myapp.pl
Web application available at http://127.0.0.1:3000

For better scalability (epoll, kqueue) and to provide non-blocking name resolution, SOCKS5 as well as TLS support, the optional modules EV (4.32+), Net::DNS::Native (0.15+), IO::Socket::Socks (0.64+) and IO::Socket::SSL (2.009+) will be used automatically if possible. Individual features can also be disabled with the MOJO_NO_NNR, MOJO_NO_SOCKS and MOJO_NO_TLS environment variables.

See "DEPLOYMENT" in Mojolicious::Guides::Cookbook for more.

SIGNALS

The Mojo::Server::Morbo process can be controlled at runtime with the following signals.

INT, TERM, HUP

Shut down server immediately. The server, all "exec" commands and their subprocesses get a TERM signal, and will be killed if they have not stopped after 5 seconds, just like for restarts.

ATTRIBUTES

Mojo::Server::Morbo implements the following attributes.

backend

my $backend = $morbo->backend;
$morbo      = $morbo->backend(Mojo::Server::Morbo::Backend::Poll->new);

Backend, usually a Mojo::Server::Morbo::Backend::Poll object.

daemon

my $daemon = $morbo->daemon;
$morbo     = $morbo->daemon(Mojo::Server::Daemon->new);

Mojo::Server::Daemon object used to create listen sockets. Other settings will be ignored, since the server runs in a separate process, use options of the server command instead.

exec

my $commands = $morbo->exec;
$morbo       = $morbo->exec(['npx webpack --watch', 'npx tailwindcss -i app.css -o public/assets/app.css --watch']);

Shell commands to start alongside the server, like asset bundlers in watch mode. The MOJO_MODE environment variable will be set to the operating mode of your application, so commands can use it too. STDIN of all commands is a pipe that gets closed when Morbo exits, even if it gets killed unexpectedly, which some tools use to shut down. When a command exits on its own, a message with its exit status is written to STDERR.

silent

my $bool = $morbo->silent;
$morbo   = $morbo->silent($bool);

Disable console messages, defaults to a true value.

METHODS

Mojo::Server::Morbo inherits all methods from Mojo::Base and implements the following new ones.

run

$morbo->run('script/my_app');
$morbo->run('script/my_app', 'prefork', '-w', 1);

Run server command for application and wait for "SIGNALS". The command defaults to daemon.

SEE ALSO

Mojolicious, Mojolicious::Guides, https://mojolicious.org.