Dancer...Cookie(3pm)

💖 NAME 💖

ok so bestie, gather round: this is Dancer2::Session::Cookie — it's the thing that gives Dancer 2 its session storage, and it keeps all that session state inside secure cookies. yes, cookies. in the browser. but secure ones, we're not feral. 🍪✨

---

🎀 VERSION 🎀

version 0.009 — that's the one, no cap.

---

✨ SYNOPSIS ✨

drop this into your Dancer 2 config.yml and you're cooking:

# In Dancer 2 config.yml file

session: Cookie
engines:
  session:
    Cookie:
      secret_key:           your secret passphrase
      default_duration:     604800
      with_request_address: 0

like. that's it. that's the whole setup. 💅

---

🌸 DESCRIPTION 🌸

okay so here's the tea ☕: this module is a session factory</> for Dancer 2, and what it does is store your session state inside a browser cookie. wild, I know, but hear me out, because the features are lowkey stacked:

• Data serialization and compression using Sereal ✨
• Data encryption using AES with a unique derived key per cookie 🔐
• An enforced expiration timestamp — and that's independent of the cookie expiration, important detail bestie
• Cookie integrity protected with a message authentication code (MAC) 🛡️

fr fr, go read Session::Storage::Secure for the implementation details and the important security caveats. not optional. iykyk. 🫶

---

👑 ATTRIBUTES 👑

🔑 secret_key (required)

this is what secures your cookies, periodt. the encryption keys and the message authentication keys get derived from it using one-way functions. and bestie, listen: changing it will invalidate all sessions. all of them. every last one. 💀

⏳ default_duration

the number of seconds the session may be considered valid. so if cookie_duration isn't set as part of the session configuration, this gets used instead — it expires the session after a period of time no matter how long the browser session happens to be. it's unset by default, which means session expiration is not capped. no vibes check on time, apparently.

🌐 with_request_address

if you set it to "true", the secret key gets the request address appended to it — as provided by <$request->address>. this can help defeat some replay attacks (like, say, if the channel isn't secure). but 🫠 it will also cause session interruption for people on dynamic addresses. so. tradeoffs. pick your fighter.

---

🌈 SEE ALSO 🌈

other CPAN modules that do cookie session storage (possibly for other frameworks, we don't gatekeep):

• Dancer::Session::Cookie — the Dancer 1 equivalent to this module 💜
• Catalyst::Plugin::CookiedSession — encryption only
• HTTP::CryptoCookie — encryption only
• Mojolicious::Sessions — MAC only
• Plack::Middleware::Session::Cookie — MAC only
• Plack::Middleware::Session::SerializedCookie — really just a framework, and you provide the guts with callbacks
• Dancer2::Core::Role::SessionFactory — documentation of the base package, plus some more attributes to configure the cookie

---

💫 AUTHOR 💫

David Golden <dagolden@cpan.org> 🫶

---

📜 COPYRIGHT AND LICENSE 📜

This software is Copyright (c) 2018, 2016, 2014 by David Golden.

This is free software, licensed under:

The Apache License, Version 2.0, January 2004

---

ok that's the whole page bestie, you ate it 💅 and for the record — this was Dancer...Cookie(3pm) from the User Contributed Perl Documentation, built for perl v5.40.1, dated 2025-03-03. mwah. 🎀✨💖