Question

I’m having an issue with storing sessions in a MySQL database using CGI::Session.

Here is a snippet

#!/usr/bin/perl

use CGI;
use CGI::Session;
use CGI::Session::Driver::mysql;
use DBI;
use DBD::mysql;
use Net::LDAPS;

require '../include/include.pl';

$LDAP_SERVER = 'my.test.ldap.example.com';
$LDAP_SSL_PORT = '636';
$LDAP_BASE = 'ou=users,dc=example,dc=com';

$ldap = Net::LDAPS->new($LDAP_SERVER, port=> $LDAP_SSL_PORT)
    or die "Unable to create LDAP object because: $! \n";

$dbh = DBI->connect("DBI:mysql:host=$db_host;database=$db_name",$db_user,$db_pswd)
    or die "Unable to connect to database: \"$DBI::errstr\" $! \n";

$q = CGI->new;

$usr = $q->param('usr') || undef;
$userDN = "uid=$usr,$LDAP_BASE";

if($usr) {
    $pwd = $q->param('pwd');
    $ldapMsg = $ldap->bind($userDN, password=>$pwd);
    $result = $ldap->code;

    if ($result == 0) {
        $session = CGI::Session->new('driver:mysql', undef, 
                     {  TableName=>'car_sessions',
                        IdColName=>'id',
                        DataColName=>'a_session',
                        Handle=>$dbh})
            or die "Unable to create session because: $!";

        $session->expire('+1h');
        $session->param(-name=>'car_login', -value=>$usr);
        $sess_cookie = $q->cookie(-name=>'CGISESSID', -value=>$session->id, -expires=>'+1h', -path=>'/hr_car/');
        $login_cookie = $q->cookie(-name=>'car_login', -value=>$usr, -expires=>'+1h', -path=>'/hr_car/');
        print $q->header(-cookie=>[$sess_cookie, $login_cookie], -location=>'manage.cgi');
    }

LDAP is binding correctly, and the cookies are being set correctly, but NOTHING is showing up in my sessions table!

What could I be doing wrong??

Answer 1

I believe the problem is with auto-flushing being unreliable. There’s an explicit problem with DBI handles going out of scope before auto-flush happens, so call $session->flush once you’re done setting the session up and after you delete it.

You may mitigate this problem by using file-scoped lexicals instead of globals for $dbh and friends, Perl might be able to clean them up in the right order and it’s just a good idea.

PS Turn on strict and warnings and declare all those variables. Your problem could have just as easily been caused by a typo and you’d never have known it.