Apache-ASP

 view release on metacpan or  search on metacpan

ASP.pm  view on Meta::CPAN

default 0. Sets HttpOnly flag to session cookie to mitigate XSS attacks.
Supported by most modern browsers, it only allows access to the
session cookie by the server (ie NOT Javascript)

  PerlSetVar HTTPOnlySession 1

=item ParanoidSession

default 0.  When true, stores the user-agent header of the browser 
that creates the session and validates this against the session cookie presented.
If this check fails, the session is killed, with the rationale that 
there is a hacking attempt underway.

This config option was implemented to be a smooth upgrade, as
you can turn it off and on, without disrupting current sessions.  
Sessions must be created with this turned on for the security to take effect.

This config option is to help prevent a brute force cookie search from 
being successful. The number of possible cookies is huge, 2^128, thus making such
a hacking attempt VERY unlikely.  However, on the off chance that such

ASP.pm  view on Meta::CPAN

 ++ Runtime speed enhancements for 15-20% improvement including:
   + INTERNAL API ReadFile() now returns scalar ref as memory optimization
   + cache InodeNames config setting in ASP object now for common lookups
   + removed CompileChecksum() INTERNAL API, since it was an unnecesary
     method decomposition along a common code path
   + removed IsChanged() INTERNAL API since compiling of scripts
     is now handled by CompileInclude() which does this functionality already
   + removed unnecessary decomp of IncludesChanged() INTERNAL API, which was along
     critical code path
   + do not call INTERNAL SearchDirs() API when compiling base script
     since we have already validated its path earlier
   + Use stat(_) type shortcut for stat() & -X calls where possible
   + Moved @INC initilization up to handler() & consolidated with $INCDir lib
   + removed useless Apache::ASP::Collection::DESTROY
   + removed useless Apache::ASP::Server::DESTROY
   + removed useless Apache::ASP::GlobalASA::DESTROY
   + removed useless Apache::ASP::Response::DESTROY

 - Default path for $Response->{Cookies} was from CookiePath
   config, but this was incorrect as CookiePath config is only
   for $Session cookie, so now path for $Response->{Cookies}

README  view on Meta::CPAN

    HTTPOnlySession
        default 0. Sets HttpOnly flag to session cookie to mitigate XSS attacks.
        Supported by most modern browsers, it only allows access to the session
        cookie by the server (ie NOT Javascript)

          PerlSetVar HTTPOnlySession 1

    ParanoidSession
        default 0. When true, stores the user-agent header of the browser that
        creates the session and validates this against the session cookie
        presented. If this check fails, the session is killed, with the
        rationale that there is a hacking attempt underway.

        This config option was implemented to be a smooth upgrade, as you can
        turn it off and on, without disrupting current sessions. Sessions must
        be created with this turned on for the security to take effect.

        This config option is to help prevent a brute force cookie search from
        being successful. The number of possible cookies is huge, 2^128, thus
        making such a hacking attempt VERY unlikely. However, on the off chance

README  view on Meta::CPAN

         ++ Runtime speed enhancements for 15-20% improvement including:
           + INTERNAL API ReadFile() now returns scalar ref as memory optimization
           + cache InodeNames config setting in ASP object now for common lookups
           + removed CompileChecksum() INTERNAL API, since it was an unnecesary
             method decomposition along a common code path
           + removed IsChanged() INTERNAL API since compiling of scripts
             is now handled by CompileInclude() which does this functionality already
           + removed unnecessary decomp of IncludesChanged() INTERNAL API, which was along
             critical code path
           + do not call INTERNAL SearchDirs() API when compiling base script
             since we have already validated its path earlier
           + Use stat(_) type shortcut for stat() & -X calls where possible
           + Moved @INC initilization up to handler() & consolidated with $INCDir lib
           + removed useless Apache::ASP::Collection::DESTROY
           + removed useless Apache::ASP::Server::DESTROY
           + removed useless Apache::ASP::GlobalASA::DESTROY
           + removed useless Apache::ASP::Response::DESTROY

         - Default path for $Response->{Cookies} was from CookiePath
           config, but this was incorrect as CookiePath config is only
           for $Session cookie, so now path for $Response->{Cookies}

site/changes.html  view on Meta::CPAN

 ++ Runtime speed enhancements for 15-20% improvement including:
   + INTERNAL API ReadFile() now returns scalar ref as memory optimization
   + cache InodeNames config setting in ASP object now for common lookups
   + removed CompileChecksum() INTERNAL API, since it was an unnecesary
     method decomposition along a common code path
   + removed IsChanged() INTERNAL API since compiling of scripts
     is now handled by CompileInclude() which does this functionality already
   + removed unnecessary decomp of IncludesChanged() INTERNAL API, which was along
     critical code path
   + do not call INTERNAL SearchDirs() API when compiling base script
     since we have already validated its path earlier
   + Use stat(_) type shortcut for stat() & -X calls where possible
   + Moved @INC initilization up to handler() & consolidated with $INCDir lib
   + removed useless Apache::ASP::Collection::DESTROY
   + removed useless Apache::ASP::Server::DESTROY
   + removed useless Apache::ASP::GlobalASA::DESTROY
   + removed useless Apache::ASP::Response::DESTROY

 - Default path for $Response->{Cookies} was from CookiePath
   config, but this was incorrect as CookiePath config is only
   for $Session cookie, so now path for $Response->{Cookies}

site/config.html  view on Meta::CPAN

session cookie by the server (ie NOT Javascript)
<font face="courier new" size=3><pre>
  PerlSetVar HTTPOnlySession 1
</pre></font>
	
	<p>
	<a name=ParanoidSess9085f1d5></a>
	<font face=verdana><font class=title size=-1 color=#555555><b>ParanoidSession</b></font>
<font face="courier new" size=3><pre>
</pre></font>default 0.  When true, stores the user-agent header of the browser 
that creates the session and validates this against the session cookie presented.
If this check fails, the session is killed, with the rationale that 
there is a hacking attempt underway.
<font face="courier new" size=3><pre>
</pre></font>This config option was implemented to be a smooth upgrade, as
you can turn it off and on, without disrupting current sessions.  
Sessions must be created with this turned on for the security to take effect.
<font face="courier new" size=3><pre>
</pre></font>This config option is to help prevent a brute force cookie search from 
being successful. The number of possible cookies is huge, 2^128, thus making such
a hacking attempt VERY unlikely.  However, on the off chance that such