I am successful in retrieving a past session, ...

If you close the window but are using cookie's to 'remember' the session id then indeed the session id will be sent to the server when you re-invoke the CGI.   All should work.   Are you using cookie's?     (That was the meaning behind my mention of $session->header() above)

Name of the cookie and query string parameters are assumed to be CGISESSID by default.

    http://.../cgi-bin/test.pl?CGISESSID=1206ccd6ed4e985a6640b9943d419410

But as you mention CGI::Application you are likely using or planning to use forms.   You would need to embed the session id as a hidden value in one of your forms.   If you want CGI::Session to find it you would have to name the hidden field 'CGISESSID', as you mention.   You could "view source" from your browser to make sure you are actually getting this information into your form.

They key to all this is knowing when the session id value is getting _back_ to your CGI for CGI::Session to find.   The more I look/test my own app the more I am convinced my leftover files are from abandoned transactions.   (I think the CGI::Session docs ought to mention the need for something like a cron job to clean up old left-over files every so often.)

Abandoned sessions (e.g. a user session is created and the user never returns) will never be accessed again so the CGI::Session will never check to see if they have expired.

The following code can be run from the command line and will delete expired session files (and will print out the IDs that have been deleted). NOTE: I've only minimally tested this on Win2k. You might want to perform some thorough testing before deploying this in a production environment.

use strict;
use File::Find;
use CGI::Session;

use constant SESSION_DIR    => '/tmp/';

find( \&wanted, SESSION_DIR );

sub wanted {
    return unless /^cgisess_(.*)/;
    my $s = CGI::Session->new( undef, $1, { Directory => SESSION_DIR }
+ );
    $s->delete && print "$1\n" if $s->is_new;
}
[download]

The code will look through all "cgisess" files, assuming they're stored in /tmp. If the session has expired it will be auto-deleted by CGI::Session. However, CGI::Session then creates a NEW session, so we have to delete it before we exit out or we'll just create a new file to replace the one we've deleted! CAVEAT: This code modifies the ATIME on un-expired sessions.

Thanks for your code.   After seeing more than a couple files build up in my /tmp/ directory I went back to the docs and realized something.   The existing package is all about CGI and sessioning  (well, duh)  but has little for admin/debugging.   The caveat you mention is rather spooky and can't be avoided with the existing API.   It might be nice to have a 'peek' method that wouldn't affect anything to do with the 'state' of the session, such as time of last access.   (Sure wish I had some of that "free time" people keep mentioning...)

Right, as soon as you load up a session, the ATIME is updated.

The only other option would be to slurp up the contents of the session file, "thaw" it (with whatever you're using as a serializer), and manually check its expiration.

Since we're dealing with an expiration interval of only 5 minutes, the ATIME modification isn't so much of a concern. However, as the expiration interval increases, the modification of the ATIME value becomes more troublesome.

--
"To err is human, but to really foul things up you need a computer." --Paul Ehrlich