[cgiapp] enciphered-cookie-only sessions

[Jason Purdy]

This probably goes without saying, but I would add that this approach 
isn't for every application.  For example, we have an e-commerce 
application that has our user leaving our site to complete a credit card 
transaction and then comes back to our site to complete the order with 
the session id.  Very rarely, a disconnect happens where the user has 
paid at the credit card site and their cookie was deleted on the client 
side.  When that does happen, I'm able to manually reconcile the credit 
card transaction against the session information we have on our server.

If we used this technique and that disconnect happened, I would have to 
void the transaction because I have lost the order information.

- Jason

Ricardo SIGNES wrote:
> Leon Brocard recently uploaded this:
> 
>   http://search.cpan.org/~lbrocard/Catalyst-Plugin-CookiedSession-0.32/lib/Catalyst/Plugin/CookiedSession.pm
> 
> It's a Catalyst plugin that stores your whole session in the cookie.  It's
> stored as a base64-encoded, Rijndael-enciphered, JSON-encoded string.  This
> seemed like a swell idea for me, since:
> 
>   a. I'm tired of session files cluttering things up.
>   b. I don't feel like creating a session db.
>   c. My session contents are tiny.
> 
> I threw together a quick implementation last night, just for Rubric, and I've
> already replaced my use of CAP::Session with it.  I'll refactor it for use as a
> real plugin later this week, probably.
> 
>   http://git.codesimply.com/?p=Rubric;a=blob;f=lib/Rubric/WebApp/Session.pm;h=3c5f79623f02268a0512487d62e976c7fc0b47aa;hb=HEAD
>