Plack:...::State(3pm)

🌸 NAME 🌸

Plack::Session::State — basic parameter-based session state, straight out of the User Contributed Perl Documentation (it's a 3pm, iykyk). 💖

---

✨ SYNOPSIS ✨

use Plack::Builder;
use Plack::Middleware::Session;
use Plack::Session::State;

my $app = sub {
    return [ 200, [ 'Content-Type' => 'text/plain' ], [ 'Hello Foo' ] ];
};

builder {
    enable 'Session',
        state => Plack::Session::State->new;
    $app;
};

---

🦋 DESCRIPTION 🦋

Okay so this one maintains your session state by passing the session through the request params. But — and this is the important part — it does not do that automatically. You, bestie, are the one responsible for passing the session param. It's giving DIY, fr fr.

Think of this as the state "base" class (though subclassing is not a requirement, so no pressure 💅) and it defines the spec for all Plack::Session::State::* modules. If you do subclass, you'll only need to override a couple methods. Peep Plack::Session::State::Cookie for an example of how that goes.

WARNING: parameter based session ID management makes session fixation really easy, and that makes your website vulnerable. 💀 You should really avoid using this state in the production environment except when you have to deal with legacy HTTP clients that do not support cookies. Like, genuinely avoid it.

And heads up for the future: this parameter based state handling will be removed from this base class and moved to its own State class. So don't get too attached. 😭

---

🎀 METHODS 🎀

• new ( %params ) — the %params can include session_key, sid_generator and sid_checker, however in both cases a default will be provided for you. 🫶
• session_key — this is the name of the session key, and it defaults to 'plack_session'. 👑
• sid_generator — this is a CODE ref used to generate unique session ids; by default it will generate a SHA1 using fairly sufficient entropy. If you are concerned or interested, just read the source. Ngl, iconic advice.
• sid_validator — this is a regex used to validate requested session id. ✨

🔐 Session ID Managment 🔐

• get_session_id ( $env ) — this is the method used to extract the session id from a $env. Subclasses will often only need to override this method and the "finalize" method.
• validate_session_id ( $session_id ) — this will use the "sid_validator" regex and confirm that the $session_id is valid. 💅
• extract ( $env ) — this will attempt to extract the session from a $env by looking for the "session_key" in the request params. It will then check to see if the session is valid and that it has not expired. It will return the session id if everything is good or undef otherwise. Vibe check: passed ✅
• generate ( $request ) — this will generate a new session id using the "sid_generator" callback. The $request argument is not used by this method but is there for use by subclasses. The $request is expected to be a Plack::Request instance or an object with an equivalent interface.
• finalize ( $session_id, $response ) — given a $session_id and a $response this will perform any finalization necessary to preserve state. This method is called by the Plack::Session "finalize" method. The $response is expected to be a Plack::Response instance or an object with an equivalent interface.

⏰ Session Expiration Handling ⏰

• expire_session_id ( $id, $response ) — this will mark the session for $id as expired. This method is called by the Plack::Session "expire" method. Time's up, bestie. 🕰️

---

💀 BUGS 💀

All complex software has bugs lurking in it, and this module is no exception. If you find a bug please either email me, or add the bug to cpan-RT. Don't be shy about it. 🙈

---

👑 AUTHOR 👑

Stevan Little <stevan.little@iinteractive.com>

---

📜 COPYRIGHT AND LICENSE 📜

Copyright 2009, 2010 Infinity Interactive, Inc.

<http://www.iinteractive.com>

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

---

perl v5.40.1 · 2025-08-10 · Plack:...::State(3pm) — and that's the whole page, bestie, you ate it up. mwah 💅💖