/ 
http-session-0.54
⭐ Starred 16

Changes for version 0.54 - 2026-06-27

  • This distribution is now deprecated (x_deprecated). Use Plack::Middleware::Session instead. This module will no longer be maintained or receive further updates.
  • HTTP::Session::ID::Urandom now draws from Crypt::URandom instead of reading /dev/urandom directly, for portability and speed, and is now the default session-ID backend.
  • Fix predictable session-ID generation in HTTP::Session::ID::MD5 and HTTP::Session::ID::SHA1 (CVE-2026-3256): they now hash cryptographically secure random bytes from Crypt::URandom instead of a time/PID/rand()-based value. Their hexadecimal output format is unchanged.
  • HTTP::Session::Store::CHI now filters session ids the same way HTTP::Session::Store::Memcached does, rejecting control characters and overly long ids before passing them to the backend.

Documentation

README.md

Modules

HTTP::Session
(DEPRECATED) simple session
HTTP::Session::State::Cookie
Maintain session IDs using cookies
HTTP::Session::State::Null
nop
HTTP::Session::State::Test
state module for testing
HTTP::Session::State::URI
embed session id to uri
HTTP::Session::Store::CHI
store session data with CHI
HTTP::Session::Store::DBM
DBM session store
HTTP::Session::Store::File
File session store
HTTP::Session::Store::Memcached
store session data in memcached
HTTP::Session::Store::Null
dummy module for session store
HTTP::Session::Store::OnMemory
store session data on memory
HTTP::Session::Store::Test
store session data on memory for testing

Provides

HTTP::Session::Expired
in lib/HTTP/Session/Expired.pm
HTTP::Session::Finalized
in lib/HTTP/Session/Finalized.pm
HTTP::Session::ID::MD5
in lib/HTTP/Session/ID/MD5.pm
HTTP::Session::ID::SHA1
in lib/HTTP/Session/ID/SHA1.pm
HTTP::Session::ID::Urandom
in lib/HTTP/Session/ID/Urandom.pm
HTTP::Session::State::Base
in lib/HTTP/Session/State/Base.pm
HTTP::Session::State::Mixin::ResponseFilter
in lib/HTTP/Session/State/Mixin/ResponseFilter.pm

Examples

Other files