digger has asked for the wisdom of the Perl Monks concerning the following question:

Revered Monks,

I am currently working on a project that will have a members only area that requires some authentication and session tracking. Examining the excellent CPAN, I find and decide to use CGI::Session to manange my sessions. The code I am using to create my session and cookie is below.

Hosting Environment: Win32 & IIS thru Verio. 

use lib ('path/to/my/lib');
use strict;
use CGI qw(:standard);
use CGI::Carp('fatalsToBrowser');
use Win32::ODBC;
use CGI::Session;

my $q = new CGI;
my $session = new CGI::Session("driver:File", $q, {Directory=>'..\sess
+ions'});

---do db search----
    if ($found) {
        $session->param("name", $memb_name);

        #set a cookie
        my $cookie = $q->cookie(-name     =>'member',
                                -value    =>'test',
                                -domain   =>'.relationshiphelp.org',
                                -expires  =>"+3h",
                                CGISESSID =>$session->id);
        print $q->header(-cookie=>$cookie);
        print $session->param("name")."<br>";
        print "Found your user id <br>";
        print $session->id;
        return 1;
    }

[download]
1. If I don't use CGI::Cookie explicitly and then create my cookie using it's methods directly, I never even get a cookie. The CGI.pm cookie method doesn't throw any errors, I just don't get a cookie. I installed the latest version of CGI.pm in my local lib, and no luck. I have Super Searched and Googled to no avail.

2. When I do get a cookie using the method above, it doesn't have the CGISESSID in it. I look at it with ethereal as it comes in, and open the resulting cookie in a text editor after the fact, and the sesion ID isn't there. I can print the session id variable and it appears to be generated correctly, I just can't get it in the cookie.

Is my code obviously flawed? Did I miss a caveat in my searching? I have played with CGI::Session in the past, and gotten this to work with a test script in a BSD hosting environment. Is there an issue with Win32?

Any direction is greatly appreciated.

Replies are listed 'Best First'.
Re: CGI.pm, CGI::Session and Cookies
by jdtoronto (Prior) on Feb 09, 2004 at 20:55 UTC
    You are tantalisingly close - here is how it should be! 
        my $session_cookie = $q->cookie( -name => 'CGISESSID',
        -value => $sess->id,
        );

    [download]
    CGI::Session is expecting the cookie name to be CGISESSID. You are naming the cookie something else. Don't put anything else in the cookie, just the session-id and that will be fine. Of course you need to set the expiry values and the domain.

    Then once you have the session you can save the other things in the session, not the cookie. ,P. jdtoronto

[reply]
[d/l]
      If I could ++ you triple, I would. I can't believe I misunderstood the docs so completely. Thanks for pointing out my obvious problem.

      digger
[reply]
        Thank you, digger, but it is such an easy thing to do! I remember when I first tried working with CGI::Session, it took me days to get a grasp of it. The documentation is good, but is not always easily understood.

        jdtoronto

[reply]

Back to Seekers of Perl Wisdom