/ 
Mojolicious-1.0
⭐ Starred 2674 / Mojo::Server::Hypnotoad
Security Advisories (11)
CPANSA-Mojolicious-2022-03 (2022-12-10)

Mojo::DOM did not correctly parse <script> tags.

CPANSA-Mojolicious-2021-02 (2021-06-01)

Small sessions could be used as part of a brute-force attack to decode the session secret.

CVE-2021-47208 (2021-03-16)

A bug in format detection can potentially be exploited for a DoS attack.

CPANSA-Mojolicious-2018-03 (2018-05-19)

Mojo::UserAgent was not checking peer SSL certificates by default.

CPANSA-Mojolicious-2018-02 (2018-05-11)

GET requests with embedded backslashes can be used to access local files on Windows hosts

CVE-2018-25100 (2018-02-13)

Mojo::UserAgent::CookieJar leaks old cookies because of the missing host_only flag on empty domain.

CPANSA-Mojolicious-2015-01 (2015-02-02)

Directory traversal on Windows

CPANSA-Mojolicious-2014-01 (2014-10-07)

Context sensitivity of method param could lead to parameter injection attacks.

CVE-2011-1589 (2011-04-05)

Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.

CVE-2011-1841 (2011-03-10)

Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies.  An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.

NAME

Mojo::Server::Hypnotoad - ALL GLORY TO THE HYPNOTOAD!

SYNOPSIS

use Mojo::Server::Hypnotoad;

my $toad = Mojo::Server::Hypnotoad->new;
$toad->run('myapp.pl', 'hypnotoad.conf');

DESCRIPTION

Mojo::Server::Hypnotoad is a full featured UNIX optimized preforking async io HTTP 1.1 and WebSocket server built around the very well tested and reliable Mojo::Server::Daemon with TLS, Bonjour, epoll, kqueue and hot deployment support that just works.

Optional modules IO::KQueue, IO::Epoll, IO::Socket::SSL and Net::Rendezvous::Publish are supported transparently and used if installed.

Note that this module is EXPERIMENTAL and might change without warning!

See Mojolicious::Guides::Cookbook for deployment recipes.

SIGNALS

You can control hypnotoad at runtime with signals.

Manager

INT, TERM

Shutdown server immediately.

QUIT

Shutdown server gracefully.

TTIN

Increase worker pool by one.

TTOU

Decrease worker pool by one.

USR2

Attempt zero downtime software upgrade (hot deployment) without losing any incoming connections.

Manager (old)
|- Worker [1]
|- Worker [2]
|- Worker [3]
|- Worker [4]
`- Manager
   |- Worker [1]
   |- Worker [2]
   |- Worker [3]
   `- Worker [4]

The new manager will automatically send a QUIT signal to the old manager and take over serving requests after starting up successfully.

Worker

INT, TERM

Stop worker immediately.

QUIT

Stop worker gracefully.

CONFIGURATION

Hypnotoad configuration files are normal Perl scripts returning a hash.

# hypnotoad.conf
{listen => ['http://*:3000', 'http://*:4000'], workers => 10};

The following parameters are currently available.

accepts
accepts => 100

Maximum number of connections a worker is allowed to accept before stopping gracefully, defaults to 1000. Setting the value to 0 will allow workers to accept new connections infinitely.

backlog
backlog => 128

Listen backlog size, defaults to SOMAXCONN.

clients
clients => 100

Maximum number of parallel client connections per worker process, defaults to 1000.

graceful_timeout
graceful_timeout => 15

Time in seconds a graceful worker stop may take before being forced, defaults to 30.

group
group => 'staff'

Group name for worker processes.

heartbeat_interval
heartbeat_interval => 3

Heartbeat interval in seconds, defaults to 5.

heartbeat_timeout
heartbeat_timeout => 5

Time in seconds before a worker without a heartbeat will be stopped, defaults to 2.

keep_alive_requests
keep_alive_requests => 50

Number of keep alive requests per connection, defaults to 25.

keep_alive_timeout
keep_alive_timeout => 10

Time in seconds a connection may be idle, defaults to 5.

listen
listen => ['http://*:80']

List of ports and files to listen on, defaults to http://*:8080.

lock_file
lock_file => '/tmp/hypnotoad.lock'

Full path to accept mutex lock file, defaults to a random temporary file.

pid_file
pid_file => '/var/run/hypnotoad.pid'

Full path to PID file, defaults to hypnotoad.pid in the same directory as the application.

proxy
proxy => 1

Activate reverse proxy support, defaults to the value of MOJO_REVERSE_PROXY.

upgrade_timeout
upgrade_timeout => 15

Time in seconds a zero downtime software upgrade may take before being aborted, defaults to 30.

user
user => 'sri'

User name for worker processes.

websocket_timeout
websocket_timeout => 150

Time in seconds a WebSocket connection may be idle, defaults to 300.

workers
workers => 10

Number of worker processes, defaults to 4. A good rule of thumb is two worker processes per cpu core.

METHODS

Mojo::Server::Hypnotoad inherits all methods from Mojo::Base and implements the following new ones.

run

$toad->run('script/myapp', 'hypnotoad.conf');

Start server.

SEE ALSO

Mojolicious, Mojolicious::Guides, http://mojolicio.us.