ghettofinger has asked for the wisdom of the Perl Monks concerning the following question:

Hello Monks,

A while ago, I asked for advice concerning templating systems. I got a lot of really good advice. After looking over all of the systems, I chose to work with HTML::Template. I am very happy with it. It is easy to use and seems to make sense to me. I have some questions about it though. The questions deal with sessioning.

What is the best way to authenticate a user, assign him/her a session, and then base what that user can or can not do based off of that session? Are there any modules specifically for HTML::Template that deal with this issue?

I understand the basics. It makes sense to authenticate the user server side and then assign a session to that user. I plan on “giving” the user a cookie with the session ID. When the user accesses the site, the cookie would be checked for the session and actions would be based off of the session ID.

Once this is figured out, I can tailor navigational headers to individual users and other cool things.

Your help is appreciated.

Thank you,
ghettofinger

  • Comment on HTML::Template and authenticated sessions

Replies are listed 'Best First'.
Re: HTML::Template and authenticated sessions
by samtregar (Abbot) on May 10, 2005 at 20:18 UTC
Re: HTML::Template and authenticated sessions
by dragonchild (Archbishop) on May 10, 2005 at 17:43 UTC
    You're going to want to use Template Toolkit instead of HTML::Template if you're tailoring display elements based on boolean values. You can pass a $config object to TT and then query it within your template. You have to pass discrete values to H::T and that gets really annoying to code up, both in Perl and in templates.

    • In general, if you think something isn't in Perl, try it out, because it usually is. :-)
    • "What is the sound of Perl? Is it not the sound of a wall that people have stopped banging their heads against?"
      You have to pass discrete values to H::T and that gets really annoying to code up, both in Perl and in templates.

      Say what? There's lots of ways to make this easy. Your "config object" could support a param() method, for example, allowing this to work:

      $tmpl = HTML::Template->new(filename => "...", associate => $config);

      Or your could just use a hash instead of an object and do:

      $tmpl->param(%config);

      Or you could keep your object and just write a method which returns the data in a hash, but is simpler than a full param():

      $tmpl->param($config->hash());

      In short, this is hardly a reason to drop HTML::Template (and has hardly anything to do with session handling).

      -sam

        (First off, let me say that I'm a long time H::T user, occasional TT dabbler. I love what you've done with the place, samtregar.)

        You can associate, but you have two problems, neither of which are solvable with the H::T syntax.

        1. You are going to litter your templates with a huge number of <TMPL_IF CONFIG_FOO_1> type statements.
        2. If you associate more than two objects, collisions are a very real possibility, especially if you associate your $cgi and $config objects at the same time.

        The alternative that TT provides is a method-like invocation on your objects. Plus, you have run-time includes, which H::T (AFAIK) does not support. This is much easier to work with.


        • In general, if you think something isn't in Perl, try it out, because it usually is. :-)
        • "What is the sound of Perl? Is it not the sound of a wall that people have stopped banging their heads against?"

      Actually ... one could theoretically get away with using HTML::Template::Expr ... but i do love the look and feel of Template Toolkit. :)

      jeffa

      L-LL-L--L-LL-L--L-LL-L--
      -R--R-RR-R--R-RR-R--R-RR
      B--B--B--B--B--B--B--B--
      H---H---H---H---H---H---
      (the triplet paradiddle with high-hat)
      

      Is TT what perlmonks uses? I can start using it, but I really enjoyed HTML::Template. Are there any good links talking about this subject with Template::Toolkit?

      --gf
Re: HTML::Template and authenticated sessions
by arc_of_descent (Hermit) on May 10, 2005 at 17:52 UTC

    You should check out CGI::Session. I personally would not suggest the use of a cookie as a session tracking thingie. I mean, there is always the possibility of the client side (can be a script, browser) not accepting cookies. It is relatively easy to track sessions using server side logic. Based on your session ID (which uniquely identifies each user), you can then output different HTML templates. You would of course have to decide on a convenient naming scheme for your template files, or you could generate these templates in your Perl script itself (based on session ID)

      It is relatively easy to track sessions using server side logic.

      And how do you associate each incoming request with a given session? It's either cookies or some SID on the URL ... unless, of course, you have mastered the HTTP 3.1415926 ESP extension ...


      • In general, if you think something isn't in Perl, try it out, because it usually is. :-)
      • "What is the sound of Perl? Is it not the sound of a wall that people have stopped banging their heads against?"
        Yeah, I'd like to second the above question. How the hell do you associate session id's with a client's request with out cookies? Sure you could embed session ids in the url, but that is hideously ugly and very prone to insecurities, such as sharing urls.