Re: CGI::Session "cache" issue

[Anonymous Monk]

These issues seem to be related to the cache

How did you to come to this conclusion?

Upon casual examination of your code fragment, I notice you're mixing CGI::redirect with CGI::Sessions::header, well that is never going to work, because HTTP header only get sent once.

You can't have a session without a sid.

You can only pass a sid through, cookie, url param, or form param.

Your use of CGI::Session::header suggests you want to use the cookie way, but you don't send any cookies when you use CGI::redirect

$ perl -MCGI -MCGI::Session -MDDS -le " Dump( CGI::Session->new->heade
+r ); "
$VAR1 = "Set-Cookie: CGISESSID=7259a9a49c42fea87376be33478731b8; path=
+/\r\nDate: Mo".
        "n, 23 May 2011 17:40:06 GMT\r\nContent-Type: text/html; chars
+et=ISO-8859-1".
        "\r\n\r\n";

$ perl -MCGI::Session -MDDS -le " Dump( CGI->redirect )"
$VAR1 = "Status: 302 Found\r\nLocation: http://localhost\r\n\r\n";

See CGI::Session::Tutorial, Ovid's CGI Course

Here is monkey patch

use CGI::Session;
sub CGI::Session::redirect {
    my $self = shift;
    return $self->query->redirect(-cookie => $self->cookie, @_ );
}
use DDS;
Dump( CGI::Session->new->redirect );
__END__
$VAR1 = "Status: 302 Found\r\nSet-Cookie: CGISESSID=a19147247f0207a6c3
+14b5aadc7c232".
        "a; path=/\r\nDate: Mon, 23 May 2011 17:46:15 GMT\r\nLocation:
+ http://localho".
        "st\r\n\r\n";

[Zhris]

Hello,

Thanks for responding.

Firstly note that I broke the code down, excluding un-related parts. I am actually sending the headers only once. Once I have printed the redirect header, I exit the script (exit(1)). Its doing everything fine, its just not registering that i'm logged in, if I visit the page in a particular way (i.e. from the homepage after logging in, or from a redirect index page).

I have used CGI:Session on many occassions, but never for such a task. I have read the tutorial, as well as the main documentation a few times. From what I gathered, you don't need to pass an SID, unless the user has i.e. cookies disabled. The module should handle everything automatically.

Quote from the tutorial based on this line of code "$session = CGI::Session->new () or die CGI::Session->errstr;":

"We didn't check for any session cookies above, did we? No, we didn't, but CGI::Session did. It looked for a cookie called CGISESSID, and if it found it tried to load existing session from server side storage (file in our case). If cookie didn't exist it looked for a QUERY_STRING parameter called CGISESSID. If all the attempts to recover session ID failed, it created a new session."

I have tried CGI's redirect() method, and also used a basic HTML meta refresh, which results in the same issue.

I'm not used the the style of code you have provided, i'll have to examine it more closely to see if theres anything you've shown that could fix my issue.

Chris

[Anonymous Monk]

Thanks for responding. Firstly note that I broke the code down, excluding un-related parts. I am actually sending the headers only once. Once I have printed the redirect header, I exit the script (exit(1)). Its doing everything fine, its just not registering that i'm logged in, if I visit the page in a particular way (i.e. from the homepage after logging in, or from a redirect index page).

If its doing everything fine, then why is there a problem?

redirect does not print a session cookie

No session cookie, means no session.

Your code fragment is too dense, but I was able to spot the problem (redirect without cookies)

If you follow the guidelines of How do I post a question effectively?, and post a small/short, self-contained program, which demonstrates the bug/problem, undesirable output/behaviour, we can better help you, and you can believe us when we do :)

I have used CGI:Session on many occassions, but never for such a task. I have read the tutorial, as well as the main documentation a few times. From what I gathered, you don't need to pass an SID, unless the user has i.e. cookies disabled. The module should handle everything automatically.

How do you think the module handles everything automatically?

The sid has to get passed somehow.

If you use header method, it goes by way of cookie. CGI::redirect() doesn't know about CGI::Session, so no cookie.

[Zhris]

Hello,

I have followed your advice, and I seem to have got it to work as I expect. This has though confused me entirely. How was it possible that I was even able to login, if I hadn't set the cookie on redirect. And why should it have made any difference whether I called Members.pl directly (displays logged in), compared to calling a php webpage that redirects to Members.pl (displays not logged in). Considering this, I believe my "confused" understanding was justified, unless there is some logical explanation. Just to clarify, I wasn't sure what aspect of my code may have caused the problem, therefore I wanted to provide everything that revolved around CGI::Session.

Here are the important snippets of my updated "login" code:

#create session
my $session = new CGI::Session();

#create cookie
my $session_cookie = new CGI::Cookie(
    -name => 'CGISESSID',
    -value => $session->id(),
    -domain => 'domain.com',
);

#redirect
print redirect(
    -cookie => [$session_cookie],
    -uri => $referer,
);

Thanks for your advice and persistance,

Chris