comment on

I am creating a webpage with user login functionality
When the user has registered as a member, a mail is sent to his emailaddress with an activation link. When I test this on the same computer the strangest thing happens.
If I create 2 members
I follow the activation link in the email and activate member 1 in the browser window that will popup. The member logs in, some sessionvariables are set such as

$session->param('mid' => $id_from_db);
$session->param('member_type' => $member_type_id_from_db);
$session->param("~logged-in", 1);
$session->expires("~logged-in", "+120m"); # expires ~logged-in flag in
+ 30 mins
[download]

I close the browser, I don't logout, I just close the browser.
I now tries to activate member 2 by clicking on the activation link, another browser window popup.
To my surprise the session variables from member 1 are still set wich makes it possible for me to do whatever I want into member 1's account.

I doesn't matter if I:
- Don't close member 1's browser after activation
- Close all browsers, and then try to activate member 2 again, I am still loggedin as member 1
- Skip the $session->expires("~logged-in", "+120m"); line
The same thing will still happen

Why does this happen?

I try to explain the application below

I have a CGI::Application baseclass which sets the session using CGI::Application::Plugin::Session;

sub cgiapp_init {
 # application object
 my $self = shift;

 # init session
 $self->init_session("sid");    
}


sub init_session {
 # application object
 my $self = shift;
 my $name  = shift;
    
 # change name from CGISESSID to shorter sid
 CGI::Session->name($name);
    
 # init session object    using CGI::Application::Plugin::Session
 my $session = $self->session;
    
 # send session to header
 $session->header();    
}
[download]

In my application class which inherits from the baseclass I check if the user is logged in or not

sub cgiapp_prerun {
 # application object
 my $self = shift;
  
 # check member access and redirect accordingly
 $self->accessControll;
}


sub accessControll {
 # application object
 my $self = shift;

 # get cgi query object
 my $q = $self->query();
 my %post = $q->Vars;
  
 # get session object
 my $session = $self->session;

 # if login is not old
 if($self->init() ne 2){
  # Redirect to startpage if login
  if ($session->param("~logged-in")) {
   $self->prerun_mode($config->{login_successRM});
  }
 }
  
 # after the third login attempt, redirect
 if ( $session->param("~login-trials") >= 3 ) {   
  # change password for username
  # UPDATE password in USERNAME table    
  $self->redirect_output_now('login_error');
 }
    
 # Redirect to startpage if logout
 if( $self->get_current_runmode() eq "logout"){
  $self->logout();
  $self->prerun_mode('logout');
 } 
}


#
#  $post{lg_name} and $post{lg_password} are sent from my login form
#
sub init {
 # application object
 my $self = shift;

 # get cgi query object
 my $q = $self->query();
 my %post = $q->Vars;
        
 # get session object        
 my $session = $self->session;            

 # database handle
 my $dbh = $self->param('dbh');    

 if ( $session->param("~logged-in") ) {
  return 2;  # if logged in, don't bother going further
 }

 my $lg_name  = $post{lg_name} or return;
 my $lg_psswd = $post{lg_password} or return;

 # if we came this far, user did submit the login form
 # so let's try to load his/her profile if name/psswds match
 my @sql_bind = ($lg_name, $lg_psswd, 1);
 my $sql_statement = qq/
             SELECT ID, 
                        MEMBER_TYPE_ID, 
            UNAME, 
            PWORD 
            FROM MEMBER 
            WHERE UNAME=? 
            AND PWORD=? 
            AND ACTIVE=? /;                            
 my (@loop_data) = $self->fetchLoopData($dbh, $sql_statement, @sql_bin
+d);

 if(@loop_data>0){
  # login information
  $session->param('mid' => $loop_data[0]{ID});
  $session->param('member_type' => $loop_data[0]{MEMBER_TYPE_ID});

  $session->param("~logged-in", 1);
  $session->expires("~logged-in", "+120m"); # expires ~logged-in flag 
+in 30 mins
  $session->clear(["~login-trials"]);
  return 1;
 }

 $session->param('info' => 'returnera 3');
 # if we came this far, the login/psswds do not match
 # the entries in the database
 my $trials = $session->param("~login-trials") || 0;
 return $session->param("~login-trials", ++$trials);
}
[download]

READMORE tags added by Arunbear

In reply to always logged in with CGI::Session by boboson

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		`&`
	<		`<`
	>		`>`
	[		`[`
	]		`]`

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.