Loading a session from CGI::Session

[SitrucHtims]

I'm new to perl, and am having the worst trouble loading my session data. I have two very short, very basic scripts to test the functionality.

script1.pl
   use CGI;
   use CGI::Carp qw/fatalsToBrowser warningsToBrowser/;
   use CGI::Session ( '-ip_match' );

   my $session = CGI::Session->new();
   $session->param("TestName", "TestValue");
   $session->flush();
   print $session->header(-location=>'test.pl');

script2.pl
  use CGI;
  use CGI::Carp qw/fatalsToBrowser warningsToBrowser/;
  use CGI::Session ( '-ip_match' );

  my $session = CGI::Session->load() or die CGI::Session->errstr();
  
  print $session->id . " - " . $session->param('TestName');

After script1.pl executes, I see the cookie in my browser with the CGISESSID parameter and the session ID as the value.

Looking at network traces, I see the "Cookie: CGISESSID=e3b27743bdd22a2d446abb1f9454a721\r\n" begin passed in the header data.

On the server I see the "cgisess_e3b27743bdd22a2d446abb1f9454a721" session file created in the system temp directory. Opening the session file on the server with notepad shows the (TestName and TestValue)'s are stored in the session file.

But when script2.pl tries to load the session, I get nothing. No session ID, no parameters. The result script2.pl that is displayed in the browser is a hyphen ( - ), due to print being fed the " - " string literal.

I've even tried changing CGI::Session->load() in script2.pl to CGI::Session->new(), however, this only results in returning a brand new session. Opening the new session file from the temp directory shows the "TestName" and "TestValue" do not exist.

Seeking enlightenment.

[Khen1950fx]

Plack is a "superglue" for web servers. Anonymous Monk uses CGI::Session in conjunction with Plack, but you're not using it; hence, you don't need it.

Maybe this will help:

#!/usr/bin/perl

use strict;
use warnings;
use CGI;
use CGI::Session;

my $session = CGI::Session->new();
$session->expire('5m');
$session->param( 'TestName', 'TestValue' );
my $sessionid = $session->id;
$ENV{REMOTE_ADDR} = '127.0.0.1';
$session->flush;

$session = CGI::Session->new($sessionid);
CGI::Session->import qw/-ip_match/;
$CGI::Session::IP_MATCH = 1;
print "IP_MATCH is turned on\n";

if (my $cse = CGI::Session->load($sessionid)) {
     print "Session loaded\n";
}
else {    
     die CGI::Session->errstr();
}
print $sessionid, "\n";

[SitrucHtims]

I tried your code, and it appeared to work, returning

IP_MATCH is turned on Session loaded 209957231a595d0c638d37cda1f4d2a8

but I noticed that the session ID that is printed is not pulled from the loaded session object "$cse", it's pulled from the "$sessionid" variable which was set by the original session. With that in mind, I modified the coded a little. adding

print $cse->id;

to the end.

use strict;
use warnings;
use CGI;
use CGI::Session;

my $session = CGI::Session->new();
$session->expire('5m');
$session->param( 'TestName', 'TestValue' );
my $sessionid = $session->id;
$ENV{REMOTE_ADDR} = '127.0.0.1';
$session->flush;

$session = CGI::Session->new($sessionid);
CGI::Session->import qw/-ip_match/;
$CGI::Session::IP_MATCH = 1;
print "IP_MATCH is turned on\n";

if (my $cse = CGI::Session->load($sessionid)) {
     print "Session loaded\n";
}
else {    
     die CGI::Session->errstr();
}
print $sessionid, "\n";
print $cse->id;

The result:

500 - Internal server error.
There is a problem with the resource you are looking for, and it cannot be displayed.

So it's like the session is still not loading. If I change the code a little more.

use strict;
use warnings;
use CGI;
use CGI::Session;

my $session = CGI::Session->new();
$session->expire('5m');
$session->param( 'TestName', 'TestValue' );
my $sessionid = $session->id;
$ENV{REMOTE_ADDR} = '127.0.0.1';
$session->flush;

$session = CGI::Session->new($sessionid);
CGI::Session->import qw/-ip_match/;
$CGI::Session::IP_MATCH = 1;
print "IP_MATCH is turned on\n";

my $cse = CGI::Session->load($sessionid);

if ($cse) {
     print "Session loaded\n";
}
else {    
     die CGI::Session->errstr();
}
print $sessionid, " - \n";
print $cse->id, " - \n";

I get a returned Session object, but no session data. Notice I pulled defining the "$cse" variable out of the if statement.

result of the above code is:

IP_MATCH is turned on Session loaded 35d4f016b7aca2f7b3ae032291d2ec74 - -

[Anonymous Monk]

Have you upgraded CGI/CGI::Session ?

[Anonymous Monk]

That doesn't make sense, what does $session->dump(); print?

It works for me with

$ pmvers CGI CGI::Session Plack
CGI: 3.52
CGI::Session: 4.43
Plack: 0.9976

[SitrucHtims]

CGI 3.51
CGI::Session 4.42


Don't have Plack installed. What is it, and is it required?


Also I'm using Active Perl, and the Perl Package Manager only has the versions I have installed. Where can I get the updated versions?

[SitrucHtims]

Below is the result of:

print $session->dump();

$CGI::Session = bless( { '_STATUS' => 1, '_OBJECTS' => { 'driver' => bless( { 'DataColName' => 'a_session', 'Directory' => 'C:\\Windows\\TEMP', 'IdColName' => 'id', 'TableName' => 'sessions', 'NoFlock' => 0, 'UMask' => 432 }, 'CGI::Session::Driver::file' ) }, '_CLAIMED_ID' => 'ead2b8cc2b09d83fc784e81a5799c0fe', '_DATA' => { '_SESSION_ID' => undef, '_SESSION_ATIME' => undef, '_SESSION_REMOTE_ADDR' => '172.30.5.170', '_SESSION_CTIME' => undef }, '_QUERY' => bless( { '.parameters' => [], 'use_tempfile' => 1, '.charset' => 'ISO-8859-1', '.cookies' => { 'CGISESSID' => bless( { 'value' => 'ead2b8cc2b09d83fc784e81a5799c0fe' , 'name' => 'CGISESSID', 'path' => '/' }, 'CGI::Cookie' ) }, '.fieldnames' => {}, 'param' => {}, 'escape' => 1 }, 'CGI' ), '_DRIVER_ARGS' => { 'DataColName' => 'a_session', 'IdColName' => 'id', 'TableName' => 'sessions' }, '_DSN' => { 'serializer' => 'default', 'id' => 'md5', 'driver' => 'file' } }, 'CGI::Session' )

The CGISESSID in the dump is the correct session ID, but as you can see, there is no param data.

[SitrucHtims]

All, I would like to thank you for your help in this problem. I have now figured out the solution. It is in multiple parts.

1) I am running this using Active Perl on a Windows 2008 R2 Server. When specifying the new() or load() methods with undefined attributes, they default to the system temp folder for session file creation and read. What I have discovered is that the default permissions on the "c:\windows\temp" folder are set such that a user level account can traverse folder/execute file, Create files/write data, Create folders/append data; but cannot List folder/read data. So as I was experiencing, the file was being created, but then the load method, even if it had the correct session, did not have permission to actually read the file.

2) The load method was not pulling then CGISESSID from the cookie. I still have not figured out why, but I was able to work around it by pulling the CGISESSID from the cookie myself first, then assigning it in the attributes of the method.

The updated and now working code is below.

script1.pl
   use CGI;
   use CGI::Carp qw/fatalsToBrowser warningsToBrowser/;
   use CGI::Session ( '-ip_match' );

   #my $q = new CGI;
   my $session = CGI::Session->new(undef, undef, {Directory=>'e:\tmp'}
+);
   $session->param("TestName", "TestValue");
   $session->flush();
   print $session->header(-location=>'script2.pl');



script2.pl
  use CGI;
  use CGI::Carp qw/fatalsToBrowser warningsToBrowser/;
  use CGI::Session ( '-ip_match' );
  use CGI::Cookie;

  # fetch existing cookies
  %cookies = CGI::Cookie->fetch;
  $sessionid = $cookies{'CGISESSID'}->value;

  my $session = CGI::Session->load(undef, $sessionid, {Directory=>'e:\
+tmp'}) or die CGI::Session->errstr();
  
  print $session->id . " - " . $session->param('TestName'), "<br>";
  print $session->dump() . " <-- Result of dump", "<br>";

[pazt]

Helped me a lot. Thanks

[Anonymous Monk]

i don't know why but it gives below error: Can't call method "value" on an undefined value at image.cgi line 16.