There is an undocumented method that can tell you when a new session has been created called 'is_new'. That should tell you if the session ID already existed in the data store.

However, you can not guarantee that the session ID is invalid or that it has been tampered with, because the session may have timed out legitimately, or you ran a cleanup script that removed the session from the data store. So just because a session ID doesn't exist, does not mean that someone tampered with their cookies or URL parameters.

If you are truly concerned about tampering with the session ID, then you should sign them in some way. One way to do that, is to let CGI::Session generate a new ID for you, but tack on a small unique string to the end and encrypt the whole thing before sending it to the client. You are just encrypting a random string with a bit of text at the end, but only you can decrypt it. When you decrypt the ID, check to make sure it has the known string at the end, and you know you have a valid ID. If you can not decrypt the text, then the ID was tampered with (You may not even need the unique string at the end, but I am not a cryptanalyst, so I'd add the extra pre-caution in there).

That having been said, that is a lot of work just to guarantee someone didn't mess with a randomly generated ID. You need to ask yourself if it is really that important.

In reply to Re: CGI Session behavior by cees
in thread CGI Session behavior by k_rajesh

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.