/ 
Dancer2-2.1.0
⭐ Starred 552 / Dancer2::Session::YAML
Security Advisories (1)
CVE-2026-13577 (2026-07-20)

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

NAME

Dancer2::Session::YAML - YAML-file-based session backend for Dancer2

VERSION

version 2.1.0

DESCRIPTION

This module implements a session engine based on YAML files. Session are stored in a session_dir as YAML files. The idea behind this module was to provide a human-readable session storage for the developer.

This backend is intended to be used in development environments, when digging inside a session can be useful.

This backend can perfectly be used in production environments, but two things should be kept in mind: The content of the session files is in plain text, and the session files should be purged by a CRON job.

CONFIGURATION

The setting session should be set to YAML in order to use this session engine in a Dancer2 application.

Files will be stored to the value of the setting session_dir, whose default value is appdir/sessions.

Here is an example configuration that use this session engine and stores session files in /tmp/dancer-sessions

session: "YAML"

engines:
  session:
    YAML:
      session_dir: "/tmp/dancer-sessions"
      cookie_duration: 3600    # Default cookie timeout in seconds

DEPENDENCY

This module depends on YAML.

SEE ALSO

See Dancer2::Core::Session for details about session usage in route handlers.

AUTHOR

Dancer Core Developers

COPYRIGHT AND LICENSE

This software is copyright (c) 2026 by Alexis Sukrieh.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.