/ 
Dancer2-2.1.0
⭐ Starred 552 / Dancer2::Core::Response::Delayed
Security Advisories (1)
CVE-2026-13577 (2026-07-20)

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

NAME

Dancer2::Core::Response::Delayed - Delayed responses

VERSION

version 2.1.0

SYNOPSIS

my $response = Dancer2::Core::Response::Delayed->new(
    request   => Dancer2::Core::Request->new(...),
    response  => Dancer2::Core::Response->new(...),
    cb        => sub {...},

    # optional error handling
    error_cb  => sub {
        my ($error) = @_;
        ...
    },
);

# or in an app
get '/' => sub {
    # delayed response:
    delayed {
        # streaming content
        content "data";
        content "more data";

        # close user connection
        done;
    } on_error => sub {
        my ($error) = @_;
        warning 'Failed to stream to user: ' . request->remote_address;
    };
};

DESCRIPTION

This object represents a delayed (asynchronous) response for Dancer2. It can be used via the delayed keyword.

It keeps references to a request and a response in order to avoid keeping a reference to the application.

ATTRIBUTES

request

Contains a request the delayed response uses.

In the context of a web request, this will be the request that existed when the delayed response has been created.

response

Contains a response the delayed response uses.

In the context of a web request, this will be the response that existed when the delayed response has been created.

cb

The code that will be run asynchronously.

error_cb

A callback for handling errors. This callback receives the error as its first (and currently only) parameter.

METHODS

is_halted

A method indicating whether the response has halted.

This is useless in the context of an asynchronous request so it simply returns no.

This method is likely going away.

has_passed

A method indicating whether the response asked to skip the current response.

This is useless in the context of an asynchronous request so it simply returns no.

This method is likely going away.

to_psgi

Create a PSGI response. The way it works is by returning a proper PSGI response subroutine which localizes the request and response (in case the callback wants to edit them without a reference to them), and then calls the callback.

Finally, when the callback is done, it asks the response (whether it was changed or not) to create its own PSGI response (calling to_psgi) and sends that to the callback it receives as a delayed response.

AUTHOR

Dancer Core Developers

COPYRIGHT AND LICENSE

This software is copyright (c) 2026 by Alexis Sukrieh.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.