Revision history for Perl module HTTP::Session

0.54 2026-06-27T22:35:07Z

   - This distribution is now deprecated (x_deprecated). Use
     Plack::Middleware::Session instead. This module will no longer be
     maintained or receive further updates.
   - HTTP::Session::ID::Urandom now draws from Crypt::URandom instead of
     reading /dev/urandom directly, for portability and speed, and is now the
     default session-ID backend.
   - Fix predictable session-ID generation in HTTP::Session::ID::MD5 and
     HTTP::Session::ID::SHA1 (CVE-2026-3256): they now hash cryptographically
     secure random bytes from Crypt::URandom instead of a time/PID/rand()-based
     value. Their hexadecimal output format is unchanged.
   - HTTP::Session::Store::CHI now filters session ids the same way
     HTTP::Session::Store::Memcached does, rejecting control characters
     and overly long ids before passing them to the backend.

0.53 2024-03-07T05:47:13Z

   - version up to fix PUUSE indexing problem.

0.52 2024-03-07T04:47:45Z

   - Separate HTTP::Session::Expired & HTTP::Session::Finalized
     from HTTP::Session to fix PAUSE indexing problem(reported by eserte)

0.51 2024-03-07T03:51:20Z

   - Fix regexp in test for cookie expires date format
     according to changes of CGI.pm v5.48 (ktat)

0.50 2020-02-13T14:31:27Z

    - enable to set httponly and samesite cookie options.
      (ktat)

0.49 2014-07-31T22:05:03Z

    - Better ssession id generation.

0.48 2013-01-06

    - Session::State::Cookie: Added secure option(tohae)
    - Session::State::Cookie: make CGI::Cookie parameters customizable.(matsuu)

    [0.47 not released]
    - added EXPERIMENTAL save_modified_session_only flag.

0.46 2012-01-11

    - oops

0.45 2012-01-10

    - use Module::Runtime instead of UNIVERSAL::require
    ( suggested by mst )

0.44 2011-05-26

    - do not depend to Test::Exception!

0.43 2011-02-20

    - better memcached injection detection(kazeburo++)

0.42 2011-02-20

    - detect memcached injection(reported by kazeburo++)

0.41 2011-01-12

    - do not use fucking auto_include()

0.40 2010-06-13

    - split HTTP::Session::State::MobileAgentID from core distribution.

0.39 2010-06-12

    - fresh Exporter.pm is required.

0.38 2010-06-07

    - fixed testing issue GH#1
      (reported by nihen++)

0.37 2010-06-06

    - removed State::GUID, State::MobileAttributeID from core.
      it was shipped as separated dist.

0.36 2010-06-06

    - fixed test case
    - improved package

0.35 2010-04-13

    - State::URI: do not embed session information to binary content.

0.34 2009-12-06

    - fixed test issue

0.33 2009-12-03

    - support PSGI!

0.32 2009-08-02

    - fixed deps for URI.pm

0.31 2009-06-18

    - State::URI: added / to input tag
        BEFORE: <input type="hidden" >
        AFTER:  <input type="hidden" />
      (suggested by nekokak++)

0.30 2009-02-25

    - fixed uuv warning

0.29 2009-02-01

    - fixed typo(reported by lyokato++)
        18:56  lyokato_:> Finalizedがtypoになってるみたいです><
        18:57  lyokato_:> Finailzedになってる


0.28 2008-12-17

    - fixed tests.
      some tests requires optional recommended modules.

0.27 2008-12-14

    - added HTTP::Session::State::MobileAgentID
    - cleanup temporary directory in test(by kazuho++)
    - added Store::*->cleanup. but, this is just a stub

0.26 2008-12-10

    - added Store::File(by kazuho++)
    - hack for global destruction
      (hmm... global destruction is strange...)

0.25 2008-12-06

    - fixed test

0.24 2008-11-25

    - added HTTP::Session->finalize method.

0.23 2008-11-24

    - CGI::Simple::Cookie support in HTTP::Session::State::Cookie.

0.22 2008-11-20

    - split id generator from core.
      for the portability(Digest::SHA1 is not in perl core)

0.21 2008-11-19

    - fixed typo. orz.

0.20 2008-11-18

    - no Moose; for less memory/less loadtime

0.11 2008-11-10

    - fixed test problem(no feature changes)
      reported by david++

0.10 2008-11-09

    - added Store::CHI

0.09 2008-11-07

    - added Store::DBM

0.08 2008-11-04

    - depend to HTTP::MobileAttribute

0.07 2008-11-02

    - added Store::OnMemory
    - added State::GUID

0.06 2008-10-27

    - *_filter: through when state doesn't have a filter method
    - fixed tests

0.05 2008-10-25

    - use duck typing

0.04 2008-10-25

    - remove_all was deprecated.

0.03 2008-10-24

    - fixed deps

0.02 2008-10-24

    - added $session->redirect_filter($url),
      $session->header_filter($res), $session->response_filter($res)
    - Store::Debug is renamed to Store::Test. thanks to nekokak++

0.01_05 2008-10-22

    - added regenerate_sesion_id method
    - check ip address
    - added permissive option for mobile id state.

0.01_04 2008-10-22

    - fixed session fixation bug
    - HTTP::Session::Store::Memory renamed to HTTP::Session::Store::Test
    - added sample script
    - call load_session automatically

0.01_03 2008-10-22

    - fixed deps

0.01_02 2008-10-22

    - State::Cookie: added expires option
    - State::Cookie: change attribute name

0.01_01 2008-10-21

    - development release

