You might also want to take a look at CGI::Application. There are plugins available for many things, including sessions, authentication, authorization, etc. It makes it easy to seperate the login/logout code from the web app code. It also makes it possible to write multiple web apps, and have them all share the same login/logout code. There's a bit of a learning curve, but once you get the hang of it, it will save you lots of time in the long run.