sub redir_auth {
    my $r = shift;
    $r->status( REDIRECT );
    $r->header_out( Location => '/login.cgi?'  );
    return REDIRECT;
}

sub handler {
    my $r = shift;
    my $apr = Apache::Request->new( $r );
    my $q = CGI->new;

    # let through if we're trying to login
    return OK if $r->uri =~ /login.cgi$/;

    # block if no session cookie or query
    my $asid = $q->cookie( 'asid' ) || $apr->param( 'asid' ) || 0;
    return redir_auth( $r ) unless $asid;

    # if we have a valid session, let the request pass through
    my $session = Alex::Session->new( $q );
    $session->expire('+1h');
    return OK if $session->param( "logged_in" );

    # default
    return redir_auth( $r );
}
[download]