<html><head><meta name="color-scheme" content="light dark"></head><body><pre style="word-wrap: break-word; white-space: pre-wrap;">package Mojolicious::Sessions;
use Mojo::Base -base;

use Mojo::JSON;
use Mojo::Util qw(b64_decode b64_encode);

has [qw(cookie_domain secure)];
has cookie_name        =&gt; 'mojolicious';
has cookie_path        =&gt; '/';
has default_expiration =&gt; 3600;

sub load {
  my ($self, $c) = @_;

  return unless my $value = $c-&gt;signed_cookie($self-&gt;cookie_name);
  $value =~ s/-/=/g;
  return unless my $session = Mojo::JSON-&gt;new-&gt;decode(b64_decode $value);

  # "expiration" value is inherited
  my $expiration = defined $session-&gt;{expiration} ? $session-&gt;{expiration} : $self-&gt;default_expiration;
  return if !(my $expires = delete $session-&gt;{expires}) &amp;&amp; $expiration;
  return if defined $expires &amp;&amp; $expires &lt;= time;

  my $stash = $c-&gt;stash;
  return unless $stash-&gt;{'mojo.active_session'} = keys %$session;
  $stash-&gt;{'mojo.session'} = $session;
  $session-&gt;{flash} = delete $session-&gt;{new_flash} if $session-&gt;{new_flash};
}

sub store {
  my ($self, $c) = @_;

  # Make sure session was active
  my $stash = $c-&gt;stash;
  return unless my $session = $stash-&gt;{'mojo.session'};
  return unless keys %$session || $stash-&gt;{'mojo.active_session'};

  # Don't reset flash for static files
  my $old = delete $session-&gt;{flash};
  @{$session-&gt;{new_flash}}{keys %$old} = values %$old
    if $stash-&gt;{'mojo.static'};
  delete $session-&gt;{new_flash} unless keys %{$session-&gt;{new_flash}};

  # Generate "expires" value from "expiration" if necessary
  my $expiration = defined $session-&gt;{expiration} ? $session-&gt;{expiration} : $self-&gt;default_expiration;
  my $default = delete $session-&gt;{expires};
  $session-&gt;{expires} = $default || time + $expiration
    if $expiration || $default;

  my $value = b64_encode(Mojo::JSON-&gt;new-&gt;encode($session), '');
  $value =~ s/=/-/g;
  my $options = {
    domain   =&gt; $self-&gt;cookie_domain,
    expires  =&gt; $session-&gt;{expires},
    httponly =&gt; 1,
    path     =&gt; $self-&gt;cookie_path,
    secure   =&gt; $self-&gt;secure
  };
  $c-&gt;signed_cookie($self-&gt;cookie_name, $value, $options);
}

1;

=encoding utf8

=head1 NAME

Mojolicious::Sessions - Signed cookie based session manager

=head1 SYNOPSIS

  use Mojolicious::Sessions;

  my $sessions = Mojolicious::Sessions-&gt;new;
  $sessions-&gt;cookie_name('myapp');
  $sessions-&gt;default_expiration(86400);

=head1 DESCRIPTION

L&lt;Mojolicious::Sessions&gt; manages simple signed cookie based sessions for
L&lt;Mojolicious&gt;. All data gets serialized with L&lt;Mojo::JSON&gt; and stored
C&lt;Base64&gt; encoded on the client-side, but is protected from unwanted changes
with a C&lt;HMAC-SHA1&gt; signature.

=head1 ATTRIBUTES

L&lt;Mojolicious::Sessions&gt; implements the following attributes.

=head2 cookie_domain

  my $domain = $sessions-&gt;cookie_domain;
  $sessions  = $sessions-&gt;cookie_domain('.example.com');

Domain for session cookies, not defined by default.

=head2 cookie_name

  my $name  = $sessions-&gt;cookie_name;
  $sessions = $sessions-&gt;cookie_name('session');

Name for session cookies, defaults to C&lt;mojolicious&gt;.

=head2 cookie_path

  my $path  = $sessions-&gt;cookie_path;
  $sessions = $sessions-&gt;cookie_path('/foo');

Path for session cookies, defaults to C&lt;/&gt;.

=head2 default_expiration

  my $time  = $sessions-&gt;default_expiration;
  $sessions = $sessions-&gt;default_expiration(3600);

Default time for sessions to expire in seconds from now, defaults to C&lt;3600&gt;.
The expiration timeout gets refreshed for every request. Setting the value to
C&lt;0&gt; will allow sessions to persist until the browser window is closed, this
can have security implications though. For more control you can also use the
C&lt;expiration&gt; and C&lt;expires&gt; session values.

  # Expiration date in seconds from now (persists between requests)
  $c-&gt;session(expiration =&gt; 604800);

  # Expiration date as absolute epoch time (only valid for one request)
  $c-&gt;session(expires =&gt; time + 604800);

  # Delete whole session by setting an expiration date in the past
  $c-&gt;session(expires =&gt; 1);

=head2 secure

  my $bool  = $sessions-&gt;secure;
  $sessions = $sessions-&gt;secure($bool);

Set the secure flag on all session cookies, so that browsers send them only
over HTTPS connections.

=head1 METHODS

L&lt;Mojolicious::Sessions&gt; inherits all methods from L&lt;Mojo::Base&gt; and
implements the following new ones.

=head2 load

  $sessions-&gt;load(Mojolicious::Controller-&gt;new);

Load session data from signed cookie.

=head2 store

  $sessions-&gt;store(Mojolicious::Controller-&gt;new);

Store session data in signed cookie.

=head1 SEE ALSO

L&lt;Mojolicious&gt;, L&lt;Mojolicious::Guides&gt;, L&lt;http://mojolicio.us&gt;.

=cut
</pre></body></html>