You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modperl@perl.apache.org by Dave Rolsky <au...@urth.org> on 2004/02/23 05:38:20 UTC
[OT-ish] Good name for generic wrapper around Apache::Session?
I'd like to create a wrapper around Apache::Session that would
automatically create the session based on either a query/POST parameter,
or a cookie (or try both), based on the code in
MasonX::Request::WithApacheSession.
My plan is to basically rip out the guts of that module, release it
separately, and then rewrite the module to use it.
It will work under mod_perl or standalone, using CGI::Cookie or
Apache::Cookie, and Apache::Request or CGI.pm.
Yes, I know about Apache::SessionManager but unfortunately it is tightly
tied into mod_perl, going so far as to subclass the Apache class (which I
think is a bad idea, in this case).
I don't think this module really belongs in the Apache:: namespace, since
it's not mod_perl specific.
It may belong in the CGI:: namespace, since it is web app specific. Some
ideas that occur to me are:
CGI::SessionManager
- confusing given that we already have Apache::SessionManager &
CGI::Session
CGI::SessionWrapper
Session::Manager
Session::Wrapper
- Yeah, a new TLNS!
WebApp::Session
- Another new TLNS!
CGI::WhyHasn'tThisBeenWrittenBySomeoneElseAlready::Dammit
Ideas are very, very welcome.
-dave
/*=======================
House Absolute Consulting
www.houseabsolute.com
=======================*/
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [OT-ish] Good name for generic wrapper around Apache::Session?
Posted by Dave Rolsky <au...@urth.org>.
On Sun, 22 Feb 2004, Andrew Gaffney wrote:
> You forgot a part:
>
> CGI::WhyHasn'tThisBeenWrittenBySomeoneElseAlready::Dammit::[Session|Wrapper]
>
> Also, I don't know if apostrophies would work as Perl would think it was a quote. ;)
Actually, apostrophes _do_ work. In Perl 4, namespaces were delimited
with apostrophes instead of "::". This explains the D'oh package on CPAN.
Although I think I'd still have to use :: in the package declaration, but
a caller can write "use Has'Apostrophe" as a synonym for "use Has::Apostrophe".
-dave
/*=======================
House Absolute Consulting
www.houseabsolute.com
=======================*/
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [OT-ish] Good name for generic wrapper around Apache::Session?
Posted by Andrew Gaffney <ag...@skylineaero.com>.
Dave Rolsky wrote:
> I'd like to create a wrapper around Apache::Session that would
> automatically create the session based on either a query/POST parameter,
> or a cookie (or try both), based on the code in
> MasonX::Request::WithApacheSession.
>
> My plan is to basically rip out the guts of that module, release it
> separately, and then rewrite the module to use it.
>
> It will work under mod_perl or standalone, using CGI::Cookie or
> Apache::Cookie, and Apache::Request or CGI.pm.
>
> Yes, I know about Apache::SessionManager but unfortunately it is tightly
> tied into mod_perl, going so far as to subclass the Apache class (which I
> think is a bad idea, in this case).
>
> I don't think this module really belongs in the Apache:: namespace, since
> it's not mod_perl specific.
>
> It may belong in the CGI:: namespace, since it is web app specific. Some
> ideas that occur to me are:
>
> CGI::SessionManager
>
> - confusing given that we already have Apache::SessionManager &
> CGI::Session
>
> CGI::SessionWrapper
>
> Session::Manager
> Session::Wrapper
>
> - Yeah, a new TLNS!
>
> WebApp::Session
>
> - Another new TLNS!
>
> CGI::WhyHasn'tThisBeenWrittenBySomeoneElseAlready::Dammit
You forgot a part:
CGI::WhyHasn'tThisBeenWrittenBySomeoneElseAlready::Dammit::[Session|Wrapper]
Also, I don't know if apostrophies would work as Perl would think it was a quote. ;)
--
Andrew Gaffney
Network Administrator
Skyline Aeronautics, LLC.
636-357-1548
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [OT-ish] Good name for generic wrapper around Apache::Session?
Posted by Ged Haywood <ge...@jubileegroup.co.uk>.
Hi Dave,
On Mon, 23 Feb 2004, Dave Rolsky wrote:
> On Mon, 23 Feb 2004, Jean-Michel Hiver wrote:
>
> > Well if you write 'a wrapper around Apache::Session', then I think you
> > should call it Apache::Session::Wrapper since that's what you say it is...
>
> True enough, I guess. But the original Apache::Session namespace was a
> mistake, because it's not mod_perl-specific. OTOH, I think a lot of
> people know that now, and know to look for Apache::Session anyway.
All true. +1 vote for Apache::Session::Wrapper even if the name
should never have been Apache::Session in the first place.
73,
Ged.
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [OT-ish] Good name for generic wrapper around Apache::Session?
Posted by Dave Rolsky <au...@urth.org>.
On Mon, 23 Feb 2004, Jean-Michel Hiver wrote:
> Well if you write 'a wrapper around Apache::Session', then I think you
> should call it Apache::Session::Wrapper since that's what you say it is...
True enough, I guess. But the original Apache::Session namespace was a
mistake, because it's not mod_perl-specific. OTOH, I think a lot of
people know that now, and know to look for Apache::Session anyway.
> It'd be very nice if it was relatively straightforward to subclass your
> module. Especially the part which gets the session key. The session key
> could be from login name in HTTP authentication, could be from some ID
> embedded in the PATH_INFO. I've even seen
> http://<session_id>.domainname/ once. Who knows what people might come
> up with :)
That should certainly be easy enough.
-dave
/*=======================
House Absolute Consulting
www.houseabsolute.com
=======================*/
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [OT-ish] Good name for generic wrapper around Apache::Session?
Posted by Jean-Michel Hiver <jh...@mkdoc.com>.
Dave Rolsky wrote:
>I'd like to create a wrapper around Apache::Session that would
>
>
Well if you write 'a wrapper around Apache::Session', then I think you
should call it Apache::Session::Wrapper since that's what you say it is...
>automatically create the session based on either a query/POST parameter,
>or a cookie (or try both), based on the code in
>MasonX::Request::WithApacheSession.
>
>
It'd be very nice if it was relatively straightforward to subclass your
module. Especially the part which gets the session key. The session key
could be from login name in HTTP authentication, could be from some ID
embedded in the PATH_INFO. I've even seen
http://<session_id>.domainname/ once. Who knows what people might come
up with :)
>My plan is to basically rip out the guts of that module, release it
>separately, and then rewrite the module to use it.
>
>
Seems like a very good plan indeed :)
Best Regards,
Jean-Michel.
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [OT-ish] Good name for generic wrapper around Apache::Session?
Posted by Perrin Harkins <pe...@elem.com>.
On Wed, 2004-02-25 at 13:06, Jeffrey W. Baker wrote:
> By the way, I completely agree with all these problems.
Glad to hear it. And thanks for your willingness to turn over
maintenance. I'm hoping that the new maintainer will keep up with
patches and answer questions, but not make any serious changes, so that
the many books and articles that rely on the current behavior will still
be valid. Meanwhile, we can create an alternative module that will use
a bit less perl magic and thus be simpler for newbies to grasp.
Ironically, tie seems to make things like this harder for them rather
than easier.
- Perrin
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [OT-ish] Good name for generic wrapper around Apache::Session?
Posted by "Jeffrey W. Baker" <jw...@acm.org>.
On Tue, 2004-02-24 at 11:42, Perrin Harkins wrote:
> On Tue, 2004-02-24 at 10:44, Enrico Sorcinelli wrote:
> > Wrapper or not, I think this is the moment to decide the future of
> > Apache::Session.
>
> I'm not sure it needs to happen right this minute, but I do have an idea
> of what I would like to see happen with sessions in the mod_perl world.
>
> Apache::Session has been a problem for a long time. Part of it is
> Jeffrey's unresponsiveness to patches and bug reports, and part of it is
> the design, with the tied interface, and the save-on-DESTROY, and the
> mutually-exclusive locking. These have proved to be very problematic
> for new users, and I think most people would be better served by a
> simple OO interface with no magic.
By the way, I completely agree with all these problems. They are parts
of the reason why I'm not really that interested in developing
Apache::Session any more. The design has fundamental problems that are
not show-stoppers but also are not that great. For example there is an
unsolvable problem of exception-on-DESTROY, which would happen at
arbitrary times, except Perl won't even raise an exception in DESTROY.
This can lead to silent data loss.
Also, although I think the locking mechanism is perfectly fine and
suited for my purposes, a *lot* of people cannot understand how it
works.
-jwb
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [OT-ish] Good name for generic wrapper around Apache::Session?
Posted by Perrin Harkins <pe...@elem.com>.
On Tue, 2004-02-24 at 10:44, Enrico Sorcinelli wrote:
> Wrapper or not, I think this is the moment to decide the future of
> Apache::Session.
I'm not sure it needs to happen right this minute, but I do have an idea
of what I would like to see happen with sessions in the mod_perl world.
Apache::Session has been a problem for a long time. Part of it is
Jeffrey's unresponsiveness to patches and bug reports, and part of it is
the design, with the tied interface, and the save-on-DESTROY, and the
mutually-exclusive locking. These have proved to be very problematic
for new users, and I think most people would be better served by a
simple OO interface with no magic.
I haven't looked closely at SessionManager, and I would want to see what
Dave has cooked up too, but the kind of thing I was thinking of would
split things along these lines:
WWW::Session (distribution name)
WWW::Session::Glue (subclasses for Apache and CGI, to handle cookie/URL
stuff)
WWW::Session::Glue::ApacheFilter (mod_perl filter that adds session IDs
to all URIs)
WWW::Session::KeyGenerator (subclasses for various approaches)
This would include handling of an MD5 or SHA1 digest for verifying that
the session key was not tampered with.
Note that there is no storage class above. I don't think that storage
belongs as part of a session module at all, but rather as part of a
separate module for working with shared hashes. I'm working on an
IPC::SharedHash module which might be able to serve as a basis for
this. It's a wrapper around various modules like BerkeleyDB,
DBD::MySQL, etc.
When Dave puts out his module, maybe we can look over all the session
stuff on CPAN and figure out where to go from here.
- Perrin
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [OT-ish] Good name for generic wrapper around Apache::Session?
Posted by Enrico Sorcinelli <e....@pisa.iol.it>.
On Tue, 24 Feb 2004 14:01:36 -0500
Perrin Harkins <pe...@elem.com> wrote:
> > I was looking through the
> > source for apache::sessionmanager and it looked like you could use one or
> > the other, but not both at the same time. So I ended up using
> > apache::session and writing my own wrapper around it to do this.
>
> A patch to SessionManager would be another option. Then we could all
> benefit from it.
I agree with Perrin.
Chris, I'd be happy to patch A::SM with your improvements! :-)
by
- Enrico
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [OT-ish] Good name for generic wrapper around Apache::Session?
Posted by Perrin Harkins <pe...@elem.com>.
On Tue, 2004-02-24 at 11:53, Chris Ochs wrote:
> The key feature that I cannot find in any session manager is to
> use cookies if they exist, else fall back to using the query string. This
> is pretty much mandatory for ecommerce sites.
I'd say it's actually somewhat rare in the sites out there now, but most
people will say they want it if you offer it to them.
> I was looking through the
> source for apache::sessionmanager and it looked like you could use one or
> the other, but not both at the same time. So I ended up using
> apache::session and writing my own wrapper around it to do this.
A patch to SessionManager would be another option. Then we could all
benefit from it.
> (I avoid using CGI::anything if I can help it).
You're being a little too broad by banning the whole CGI:: namespace.
There are a lot of good modules in there, and most of them apply equally
well to mod_perl.
- Perrin
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [OT-ish] Good name for generic wrapper around Apache::Session?
Posted by Chris Ochs <ch...@paymentonline.net>.
Just to jump in here..
A few weeks ago I was looking for a session manager like the one you are
describing. The key feature that I cannot find in any session manager is to
use cookies if they exist, else fall back to using the query string. This
is pretty much mandatory for ecommerce sites. I was looking through the
source for apache::sessionmanager and it looked like you could use one or
the other, but not both at the same time. So I ended up using
apache::session and writing my own wrapper around it to do this.
I also agree on someone keeping apache::session up to date, even if it's
just to keep the versions current so they show a current date. I was
reluctant to use apache::session because it looked out of date, until I dug
around and found out that it's still one of the best all around session
managers for apache (I avoid using CGI::anything if I can help it).
Chris
----- Original Message -----
From: "Dave Rolsky" <au...@urth.org>
To: "Enrico Sorcinelli" <e....@pisa.iol.it>
Cc: <mo...@perl.apache.org>
Sent: Tuesday, February 24, 2004 8:28 AM
Subject: Re: [OT-ish] Good name for generic wrapper around Apache::Session?
> On Tue, 24 Feb 2004, Enrico Sorcinelli wrote:
>
> > > Yes, I know about Apache::SessionManager but unfortunately it is
tightly
> > > tied into mod_perl, going so far as to subclass the Apache class
(which I
> > > think is a bad idea, in this case).
> >
> > Unfortunately why?
>
> Because I want something that works outside of mod_perl as well ;) It's
> unfortunate because rather than using your code, I have to write my own.
>
> > Apache::SessionManager allows session transparent URI tracking and it
creates a
> > session object and makes it available to all other handlers (sessions
can be
> > useful in authentication/authorization phase) so I've tied A::SM with
mod_perl
> > because I don't know any Perl related technologies (other than mod_perl
itself)
> > that allows this :-)
>
> Tying it to mod_perl is fine. Subclassing it makes no sense, and would
> make it impossible to use with Apache::Filter, for example.
>
> > > Ideas are very, very welcome.
> >
> > In my working (and not yet released) A::SM version, I've had the same
idea by
> > adding a beta class wrapper to Apache::Session inside the package.
> >
> > So an idea could be: why reinventing the wheel? :-) I agree with a
unique
> > Apache::Session wrapper used by Apache::SessionManager or MasonX or ...
> >
> > BTW, I could plan to use this wrapper even for my Apache::Template and
> > CGI::Application (A::SM-based) plugins.
>
> Well, my wrapper is pretty much done, and I need it now ;) However, if
> you release yours later and it does the same stuff, I'd be happy to
> replace mine with yours.
>
> > Wrapper or not, I think this is the moment to decide the future of
> > Apache::Session. Recently, I've read many messages in this list where
people
> > says: "Apache::Session is 'out of date'" so users use CGI::Session. But
> > Apache:Session is still a valid framework(!): it needs only a better
(that is
> > continous) maintenance (for example if Jeffrey Baker cannot, I can spend
a bit
> > of time for this).
>
> Doh! Better darn you flame retardant underwear. I volunteered to
> maintain Apache::Session way back in 2001, before Jeffrey release 1.54,
> after leaving a broken 1.53 on CPAN (Flex was broken) for a _long_ time,
> and boy did he flame me. Never suggest that Jeffrey is anything less than
> a sterling pillar of the community, responsive to bug reports, and an
> all-around swell guy ;)
>
> > In the past I've made a patch to Apache::Session and I've mailed it (cc
> > also to this list) to the author without response. Moreover I've seen
other
> > unapplied patches.
>
> No, tha'ts inconceivable!
>
> > After all, why not extend Apache::Session package simply by adding the
wrapper
> > code instead of creating a new one?
>
> Well, I don't think the wrapper needs to be distributed with
> Apache::Session.
>
>
> -dave
>
> /*=======================
> House Absolute Consulting
> www.houseabsolute.com
> =======================*/
>
> --
> Report problems: http://perl.apache.org/bugs/
> Mail list info: http://perl.apache.org/maillist/modperl.html
> List etiquette: http://perl.apache.org/maillist/email-etiquette.html
>
>
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [OT-ish] Good name for generic wrapper around Apache::Session?
Posted by Dave Rolsky <au...@urth.org>.
On Tue, 24 Feb 2004, Enrico Sorcinelli wrote:
> > Yes, I know about Apache::SessionManager but unfortunately it is tightly
> > tied into mod_perl, going so far as to subclass the Apache class (which I
> > think is a bad idea, in this case).
>
> Unfortunately why?
Because I want something that works outside of mod_perl as well ;) It's
unfortunate because rather than using your code, I have to write my own.
> Apache::SessionManager allows session transparent URI tracking and it creates a
> session object and makes it available to all other handlers (sessions can be
> useful in authentication/authorization phase) so I've tied A::SM with mod_perl
> because I don't know any Perl related technologies (other than mod_perl itself)
> that allows this :-)
Tying it to mod_perl is fine. Subclassing it makes no sense, and would
make it impossible to use with Apache::Filter, for example.
> > Ideas are very, very welcome.
>
> In my working (and not yet released) A::SM version, I've had the same idea by
> adding a beta class wrapper to Apache::Session inside the package.
>
> So an idea could be: why reinventing the wheel? :-) I agree with a unique
> Apache::Session wrapper used by Apache::SessionManager or MasonX or ...
>
> BTW, I could plan to use this wrapper even for my Apache::Template and
> CGI::Application (A::SM-based) plugins.
Well, my wrapper is pretty much done, and I need it now ;) However, if
you release yours later and it does the same stuff, I'd be happy to
replace mine with yours.
> Wrapper or not, I think this is the moment to decide the future of
> Apache::Session. Recently, I've read many messages in this list where people
> says: "Apache::Session is 'out of date'" so users use CGI::Session. But
> Apache:Session is still a valid framework(!): it needs only a better (that is
> continous) maintenance (for example if Jeffrey Baker cannot, I can spend a bit
> of time for this).
Doh! Better darn you flame retardant underwear. I volunteered to
maintain Apache::Session way back in 2001, before Jeffrey release 1.54,
after leaving a broken 1.53 on CPAN (Flex was broken) for a _long_ time,
and boy did he flame me. Never suggest that Jeffrey is anything less than
a sterling pillar of the community, responsive to bug reports, and an
all-around swell guy ;)
> In the past I've made a patch to Apache::Session and I've mailed it (cc
> also to this list) to the author without response. Moreover I've seen other
> unapplied patches.
No, tha'ts inconceivable!
> After all, why not extend Apache::Session package simply by adding the wrapper
> code instead of creating a new one?
Well, I don't think the wrapper needs to be distributed with
Apache::Session.
-dave
/*=======================
House Absolute Consulting
www.houseabsolute.com
=======================*/
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [OT-ish] Good name for generic wrapper around Apache::Session?
Posted by Enrico Sorcinelli <e....@pisa.iol.it>.
On Sun, 22 Feb 2004 22:38:20 -0600 (CST)
Dave Rolsky <au...@urth.org> wrote:
Hi Dave,
> Yes, I know about Apache::SessionManager but unfortunately it is tightly
> tied into mod_perl, going so far as to subclass the Apache class (which I
> think is a bad idea, in this case).
Unfortunately why?
Apache::SessionManager allows session transparent URI tracking and it creates a
session object and makes it available to all other handlers (sessions can be
useful in authentication/authorization phase) so I've tied A::SM with mod_perl
because I don't know any Perl related technologies (other than mod_perl itself)
that allows this :-)
Moreover it's very easy to integrate A::SM in many mod_perl app server (I use
and I've used A::SM with Mason for a long time before your
MasonX::Request::WithApacheSession release)
> I don't think this module really belongs in the Apache:: namespace, since
> it's not mod_perl specific.
Yes, Apache::Session namespace is a hystorical error... :-)
> Ideas are very, very welcome.
In my working (and not yet released) A::SM version, I've had the same idea by
adding a beta class wrapper to Apache::Session inside the package.
So an idea could be: why reinventing the wheel? :-) I agree with a unique
Apache::Session wrapper used by Apache::SessionManager or MasonX or ...
BTW, I could plan to use this wrapper even for my Apache::Template and
CGI::Application (A::SM-based) plugins.
Wrapper or not, I think this is the moment to decide the future of
Apache::Session. Recently, I've read many messages in this list where people
says: "Apache::Session is 'out of date'" so users use CGI::Session. But
Apache:Session is still a valid framework(!): it needs only a better (that is
continous) maintenance (for example if Jeffrey Baker cannot, I can spend a bit
of time for this).
In the past I've made a patch to Apache::Session and I've mailed it (cc
also to this list) to the author without response. Moreover I've seen other
unapplied patches.
I've also started an experimental branch of Apache::Session in order to
customize (add) 'sessions' table fields.
After all, why not extend Apache::Session package simply by adding the wrapper
code instead of creating a new one?
by
- Enrico
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [OT-ish] Good name for generic wrapper around Apache::Session?
Posted by Perrin Harkins <pe...@elem.com>.
I would suggest Apache::SessionGlue (problematic, since it doesn't
belong under Apache) or CGI::SessionGlue. If you plan to expand it
later to offer use of CGI::Session, or a different storage mechanism
altogether, then the latter would be better.
- Perrin
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html