Concierge-Auth

 view release on metacpan or  search on metacpan

examples/02-user-management.pl  view on Meta::CPAN

=head1 BEST PRACTICES

=over 4

=item * Always check return values from user management operations

=item * Verify operations succeeded before proceeding

=item * Handle error messages appropriately for your application

=item * Test that old credentials no longer work after resets/deletions

=back

=head1 SEE ALSO

L<Concierge::Auth>, 01-basic-authentication.pl, 03-token-generation.pl

=cut

examples/04-session-management.pl  view on Meta::CPAN

}

# Simple session management system
my %active_sessions;
my $SESSION_TIMEOUT = 3600;  # 1 hour in seconds

sub create_session {
    my ($username, $password) = @_;
    
    # Authenticate user
    return (0, "Invalid credentials") unless $auth->checkPwd($username, $password);
    
    # Generate secure session token
    my $session_token = $auth->gen_random_token(32, 'url_safe');
    
    # Store session data
    $active_sessions{$session_token} = {
        username    => $username,
        created_at  => time(),
        last_active => time(),
        ip_address  => '127.0.0.1',  # In real app, get from request

examples/04-session-management.pl  view on Meta::CPAN

        my ($success, $token) = create_session($username, $password);
        if ($success) {
            # Set secure cookie
            set_cookie('session_token' => $token, {
                secure   => 1,
                httponly => 1,
                samesite => 'strict'
            });
            return success_response();
        }
        return error_response('Invalid credentials');
    }
    
    # Authentication middleware  
    sub authenticate_request {
        my $token = get_cookie('session_token');
        my $username = validate_session($token);
        
        return $username || unauthenticated_response();
    }

examples/07-error-handling.pl  view on Meta::CPAN

    return (0, "Username required") unless defined $username && length $username;
    return (0, "Password required") unless defined $password && length $password;
    
    # Validate inputs
    eval {
        $auth->validateID($username);
        $auth->validatePwd($password);
    };
    
    if ($@) {
        return (0, "Invalid credentials format");
    }
    
    # Check if user exists first
    unless ($auth->checkID($username)) {
        return (0, "Invalid credentials");
    }
    
    # Attempt authentication
    my $authenticated = $auth->checkPwd($username, $password);
    
    return $authenticated ? (1, "Authentication successful") : (0, "Invalid credentials");
}

print "Defensive programming demonstration:\n";

# Test safe registration
my @test_registrations = (
    ['validuser', 'validpassword123', 'should succeed'],
    ['', 'validpassword123', 'should fail - empty username'],
    ['validuser2', 'short', 'should fail - short password'],  
    ['invalid user', 'validpassword123', 'should fail - invalid username'],

examples/07-error-handling.pl  view on Meta::CPAN

    }

=head1 SECURITY CONSIDERATIONS

=over 4

=item * Never expose validation error details to prevent enumeration

=item * Log failed authentication attempts for monitoring

=item * Use consistent error messages for invalid credentials

=item * Implement rate limiting to prevent brute force attacks

=item * Sanitize all user input before logging

=back

=head1 SEE ALSO

L<Concierge::Auth>, 08-advanced-usage.pl, 01-basic-authentication.pl

examples/08-advanced-usage.pl  view on Meta::CPAN

    # Attempt authentication
    my $success = $auth->checkPwd($username, $password);
    
    if ($success) {
        # Clear failed attempts on successful login
        delete $failed_attempts{$username};
        return (1, 'Authentication successful');
    } else {
        # Record failed attempt
        record_failed_attempt($username);
        return (0, 'Invalid credentials');
    }
}

# Setup test user for rate limiting demo
my ($rate_fh, $rate_file) = tempfile(CLEANUP => 1);
close $rate_fh;
my $rate_auth = Concierge::Auth->new({file => $rate_file});
$rate_auth->setPwd('testuser', 'correct_password');

print "Rate limiting demonstration:\n";

examples/README.md  view on Meta::CPAN

    print "UUID: " . $auth->gen_uuid() . "\n";
'
```

## Common Patterns

### User Registration Flow
1. Validate input format
2. Check if user already exists
3. Hash password securely
4. Store user credentials
5. Return success/failure

### Authentication Flow
1. Validate input format
2. Look up user credentials
3. Verify password against hash
4. Generate session token on success
5. Return authentication result

### Session Management
1. Generate secure session token
2. Store session metadata
3. Validate token on each request
4. Update last active timestamp
5. Handle session expiration