Rotate session ID after successful login.

1 files changed, 26 insertions, 0 deletions

diff --git a/perllib/Catalyst/Plugin/FixMyStreet/Session/RotateSession.pm b/perllib/Catalyst/Plugin/FixMyStreet/Session/RotateSession.pm
new file mode 100644
index 000000000..8da88721f
--- /dev/null
+++ b/perllib/Catalyst/Plugin/FixMyStreet/Session/RotateSession.pm
@@ -0,0 +1,26 @@
+package Catalyst::Plugin::FixMyStreet::Session::RotateSession;
+use Moose::Role;
+use namespace::autoclean;
+
+# After successful authentication, rotate the session ID
+after set_authenticated => sub {
+    my $c = shift;
+    $c->change_session_id;
+};
+
+# The below is necessary otherwise the rotation fails due to the delegate
+# holding on to the now-deleted old session. See
+# https://rt.cpan.org/Public/Bug/Display.html?id=112679
+
+after delete_session_data => sub {
+    my ($c, $key) = @_;
+
+    my ($field) = split(':', $key);
+    if ($field eq 'session') {
+        $c->_session_store_delegate->_session_row(undef);
+    } elsif ($field eq 'flash') {
+        $c->_session_store_delegate->_flash_row(undef);
+    }
+};
+
+1;