view release on metacpan or  search on metacpan

lib/CGI/Tiny/Cookbook.pod  view on Meta::CPAN

      my $encoded_value = encode_base64 encode_json($hashref), '';
      $cgi->add_response_cookie(hash => $encoded_value, Path => '/');
      $cgi->render(text => "Set cookie hash key $key: $hashref->{$key}");
    } else {
      $cgi->render(text => "No cookie value set");
    }
  };

=head2 Sessions

Regardless of the session mechanism, login credentials should only be sent over
HTTPS, and passwords should be stored on the server using a secure one-way
hash, such as with L<Crypt::Passphrase>.

L<Basic authentication|https://en.wikipedia.org/wiki/Basic_access_authentication>
has historically been used to provide a simplistic login session mechanism
which relies on the client to send the credentials with every subsequent
request in that browser session. However, it does not have a reliable logout or
session expiration mechanism.

Basic authentication can be handled by the CGI server itself (e.g.
L<Apache|https://httpd.apache.org/docs/2.4/howto/auth.html>), which restricts
access to a directory or location to authenticated users, and passes
L<AUTH_TYPE|CGI::Tiny/"auth_type"> and L<REMOTE_USER|CGI::Tiny/"remote_user">
with the authenticated CGI requests.

If you want to instead handle Basic authentication directly in the CGI script,

lib/CGI/Tiny/Cookbook.pod  view on Meta::CPAN

      $cgi->add_response_header('WWW-Authenticate' => 'Basic realm="My Website", charset="UTF-8"');
      $cgi->set_response_status(401)->render;
      exit;
    }

    $cgi->render(text => "Welcome, $authed_user!");
  };

A more sophisticated and modern login session mechanism is to store a session
cookie in the client, associated with a server-side session stored in a file or
database. Login credentials only need to be validated once per session, and
subsequently the session ID stored in the cookie will be sent by the client
with each request. This type of session can be ended by expiring the session
cookie and invalidating the session data on the server.

Some HTTP session management modules exist on CPAN, but the author has not yet
discovered any that are suitable for use with CGI::Tiny. In lieu of a
generalized mechanism, session data can be stored to and retrieved from your
database of choice manually.

  #!/usr/bin/perl