This should help though I don't have time to cook up a full working example today-

print CGI::redirect( -uri => $whatever,
                     -cookie => $session->cookie,
                     -status => 302 );
[download]

You can send cookies with redirects. I don't know if CGI::Session has the ability to do headers like that but CGI.pm definitely does so give the above a shot. Remember to be careful not to double print headers. Test from the command line to be sure about the output if your code isn't trivial. The browser and server can disguise problems.

#!/usr/bin/perl -- 

use strict;
use warnings;

use CGI::Session();

my $ses = CGI::Session->new or die CGI::Session->errstr;
warn 'header : ', $ses->header;
warn 'header : ', $ses->header(-location => "/?page=1");


__END__

header : Set-Cookie: CGISESSID=de7a711a41ba8262d2f1dcb6cbf3a2ad; path=
+/
Date: Sun, 17 May 2009 03:48:43 GMT
Content-Type: text/html; charset=ISO-8859-1

header : Set-Cookie: CGISESSID=de7a711a41ba8262d2f1dcb6cbf3a2ad; path=
+/
Date: Sun, 17 May 2009 03:48:43 GMT
Location: /?page=1
Content-Type: text/html; charset=ISO-8859-1
[download]

Two things occur to me: 1) Anonymous Monk's sample shows the header looking about right but without status. The status might matter (30#) so you could try adding a flag for it. The HTTP spec requires absolute URIs for redirect locations. You're using a relative one. While relative ones work in practice most of the time you should make it absolute.

Also, I'm not positive any of this addresses your problem but have at it-

use strict;
use warnings;
use CGI ();
use CGI::Session();
use URI ();

my $session = CGI::Session->new
    or die CGI::Session->errstr;

my $uri = URI->new( CGI::url() );
$uri->query("page=1");
# might want to $uri->fragment(""), etc...

print $session->header(-location => $uri,
                       -status => 302 );

__END__
moo@cow[3505]~/bin>curl -i http://localhost/cgi/pm-764431-2.cgi
HTTP/1.1 302 Found
Date: Sun, 17 May 2009 05:20:44 GMT
Server: Apache/2.2.3 (Unix) mod_fastcgi/2.4.2
Set-Cookie: CGISESSID=0ea36d11385258e787e3b31a31f23cb1; path=/
Location: http://localhost/cgi/pm-764431-2.cgi?page=1
Content-Length: 0
Content-Type: text/html; charset=ISO-8859-1

[download]

Use URI::QueryParam for non-trivial query string manipulation.

Thanks for your thinking on this. Appreciate it much. BTW, I'd never heard of URI, however, still not quite sure why you used it :)

The only thing I don't see in your code is where you add key/value param to the session. That's what is throwing me. I need to create the new session, add a param, and then redirect. It's too many headers.

—Brad
"The important work of moving the world forward does not wait to be done by perfect men." George Eliot

Too many headers? You know that you're supposed to print headers only once.

Yeah, I'm sorry. I didn't read the original flow right. AM is right and I alluded to it above. You can't print headers twice or you'll get wonky behavior. Give something like this a spin.

my $current_page = shift || die "Need a current page";

my $session = CGI::Session->new
    or die CGI::Session->errstr;

my @pages = $session->param('authorized_pages');

push @pages, $current_page
    unless $pages[-1] eq $current_page; # Just a guess.

$session->param( authorized_pages => \@pages );
$session->flush();

my $uri = URI->new( CGI::url() );
$uri->query("page=1");
$uri->fragment("");

print $session->header(-location => $uri,
                       -status => 302 );
[download]

URI is in there to get the absolute URI and mess with the query string and fragment. Munging URI as strings is like parsing HTML with regexes. It can be done but it's error prone and why shoot yourself in the foot when there are great tools that are just as easy, if not easier.