Re: [cgiapp] Strange Problem with CAP::Authentication and CAP::Session?

["Cees Hek" <suppressed>]

On 3/24/06, Giannis Economou <suppressed> wrote:
> but these updated data NEVER reach the file on filesystem that keeps the
> session, so user in not logged in.

You might be hitting the problem with CGI::Session where sessions are
not flushed to disk properly.  Try doing an explicit flush of the
session data at the end of your code

sub teardown {
  my $self = shift;
  $self->session->flush;
}


Also, I have a quick comment on your config.  It might be that you
just cut and pasted from the docs, but you have your CAP::Session set
to timeout after 20 minutes of idle time:

>        DEFAULT_EXPIRY      => '+20m',

But in your Authentication config you have this

>    LOGIN_SESSION_TIMEOUT => {
>        IDLE_FOR => '30m',
>        EVERY    => '1d',

Which tries to force the user to reauthenticate if they are idle for
more then 30 minutes, and forces a re-authentication at least once a
day even if they are never idle for more than 30 minutes..

These second set of options aren''t really useful in your case, since
your session will expire after 20 minutes of idle time (effectively
logging the user out, since the entire session is gone), which means
that a user can never be idle for 30 minutes and still logged in.

Generally I either put a very long expiry time on my sessions, or I
don't set an expiry at all (meaning it lasts for the life of the
browser).  If there is some info that needs to expire more often (like
the authentication params), then I set the expiry on them individually
(in this case the CAP::Auth plugin handles that for you).

Cheers,

Cees

---------------------------------------------------------------------
Web Archive:  http://www.mail-archive.com/suppressed/
              http://marc.theaimsgroup.com/?l=cgiapp&r=1&w=2
To unsubscribe, e-mail: suppressed
For additional commands, e-mail: suppressed