Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Dancer2::Session::Pg Released

Closed
  • Is something wrong?
#1,848 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
5/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Active
Tech stack
perl, postgresql
Domain
backend, databases

Research direction

This is an announcement of a third-party module, Dancer2::Session::Pg, and it asks for no change to the Dancer2 codebase. There are no files, tests or entry points named, so a newcomer has nothing to start on here. Look for a concrete bug or feature request in the repository's open issues instead.

Written by the indexing model from the issue text.

Description

Hi,

I have released a new Dancer2 Session Engine: https://metacpan.org/dist/Dancer2-Session-Pg

It is specially crafted to PostgreSQL and uses Pg special SQL. Required Pg 9.5 or later.

  • Stores Dancer2 sessions in PostgreSQL, and uses PostgreSQL's own features to make that storage safer than a serialised blob in a table.

  • web session is not ordinary data. It frequently carries the credentials that prove who somebody is.

  • Authenticated encryption at rest
    The payload is encrypted with an AEAD cipher, so a dump, a backup or a support copy of the table does not hand over the contents of a session, and a row that has been altered fails to decrypt instead of deserialising into a structure the application would then trust.

  • Expiry decided by the server's clock
    expires is a timestamptz and every read filters on it. Application clocks drift; the database's clock is the one every process shares, so all of them agree about whether a session is still alive.

  • Atomic writes
    Sessions are written with INSERT ... ON CONFLICT DO UPDATE, which is atomic. Any number of workers may write one session id concurrently without producing a duplicate row, a unique violation or a deadlock, and without moving the expiry cap.

  • An optional clear column beside the encrypted payload makes it possible to find and end every session belonging to one account without decrypting anything -- see "destroy_for_principal" in Dancer2::Session::Pg. Suspending an account has little effect while the suspended user's cookie still works. That column is off by default and need not exist; "THE PRINCIPAL COLUMN" in Dancer2::Session::Pg is about whether you want it.

I am using this in my own (commercial) apps in production.

Dominant language
Perl
Stars
604
Forks
289
Avg merge
2d 23h
Merged PRs (30d)
3

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from PerlDancer/Dancer2

All issues in PerlDancer/Dancer2

Similar issues

More Perl issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.