search

preaction / Yancy

The Best Web Framework Deserves the Best Content Management System
http://preaction.me/yancy/
Other
54 stars 21 forks source link

Avoid setting session cookie until actual login #128

Closed uniejo closed 3 years ago

uniejo commented 3 years ago

The autovivification of $c->session->{yancy}{auth}{password} sets a cookie for each visitor, even when not using login. This avoids setting a cookie when just testing for current_user. (Goes better with a cookie policy, where the user is notified about cookies on the login page)

preaction commented 3 years ago

Agh! I thought Perl knew when an autovivification was on a LHS and knew not to save the result...

Thanks for the patch! Looks like the Travis build is failing due to Mojolicious adding some error checking in 8.66, so I'll have to fix that before I can add this to a release.