当使用Dancer :: Session :: Cookie在Dancer（Perl）中空闲时如何销毁cookie？

Question

Is there a built-in way to destroy a session cookie generated by Dancer::Session::Cookie after a certain amount of minutes of it being idle? I noticed that it doesn't even destroy the session when I restart either the Nginx or Starman server, which is not what I want (for security reasons).

If there is no built in way is there anything inherently wrong with storing the last time the session was active in an SQL database and updating it after every action? Then if more than 15 minutes or so have gone by without that entry being updated the session cookie will be destroyed (with session->destroy). That doesn't seem like the best solution but maybe that's the only way. From my understanding you can also manually set a cookie expiration time in the HTTP header but that would only destroy the cookie on the client-side, correct?

Answer 1

I think you want to do the reverse.

When you generate the cookie, use the expires attribute to set it to, say, "15 minutes":

https://metacpan.org/pod/Dancer::Cookie#expires

Then every time you do something for that session, call the Dancer::Cookie init method:

https://metacpan.org/pod/Dancer::Cookie#init

... to refresh the cookie (if you're not using the default path, pass in the path).

The user's browser should expire the cookie for you after the given time.

(I have not actually tried this, but the code implies it should work - the documentation for the init method could certainly be clearer)