Mailing List Archive: Catalyst: Dev

Proposal: C::Plugin::Session new option verify_user_agent

Index | Next | Previous | View Threaded

kmx at volny

Jun 12, 2009, 10:49 AM

Post #1 of 2 (843 views)
Permalink

Proposal: C::Plugin::Session new option verify_user_agent

Hi,

I have prepared a patch proposal for a new verify_user_agent
configuration option. It is very similar to verify_address; it checks
whether the User-agent string from http request header has change since
session initialization.

I know that it is not bullet-proof on the other hand a regular user does
not change his/her User-agent string so often therefore it could
contribute a bit to mitigation of session hijacking attacks.

Please have a look at SVN (I have prepared also some .t and doc patch)
http://dev.catalystframework.org/repos/Catalyst/Catalyst-Plugin-Session/0.00/branches/verify_user_agent/

I would appreciate if you could consider merging my branche into trunk.

Thanks.

--
kmx

bobtfish at bobtfish

Jun 16, 2009, 12:41 PM

Post #2 of 2 (756 views)
Permalink

Re: Proposal: C::Plugin::Session new option verify_user_agent [In reply to]

On 12 Jun 2009, at 18:49, kmx wrote:
> Please have a look at SVN (I have prepared also some .t and doc patch)
> http://dev.catalystframework.org/repos/Catalyst/Catalyst-Plugin-
> Session/0.00/branches/verify_user_agent/
>
> I would appreciate if you could consider merging my branche into
> trunk.

Committed to trunk, about to release as 0.23. Thanks for the patches
and suggestions - they are all of my list to work through as I get time!

For future reference, please branch as one commit, and then apply
your patches as a second commit.

Otherwise, it's not possible to get a diff of your branch (svn diff -
r10418:10551 http://dev.catalyst.perl.org/repos/Catalyst/Catalyst-
Plugin-Session/0.00/branches/verify_user_agent/ produces no output).

I had to diff from trunk => your branch, which would have been
inconvenient, to say the least, if there had been a load of patches
into trunk in the meantime

Cheers
t0m

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact lists@gossamer-threads.com