NAME
    Dancer::Session::Cookie - Encrypted cookie-based session backend for
    Dancer

SYNOPSIS
    Your config.yml:

        session: "cookie"
        session_cookie_key: "this random key IS NOT very random"

DESCRIPTION
    This module implements a session engine for sessions stored entirely in
    cookies. Usually only session id is stored in cookies and the session
    data itself is saved in some external storage, e.g. database. This
    module allows one to avoid using external storage at all.

    Since server cannot trust any data returned by client in cookies, this
    module uses cryptography to ensure integrity and also secrecy. The data
    your application stores in sessions is completely protected from both
    tampering and analysis on the client-side.

    Do be aware that browsers limit the size of individual cookies, so this
    method is not suitable if you wish to store a large amount of data.
    Browsers typically limit the size of a cookie to 4KB, but that includes
    the space taken to store the cookie's name, expiration and other
    attributes as well as its content.

CONFIGURATION
    The setting session should be set to "cookie" in order to use this
    session engine in a Dancer application. See Dancer::Config.

    A mandatory setting is needed as well: session_cookie_key, which should
    contain a random string of at least 16 characters (shorter keys are not
    cryptographically strong using AES in CBC mode).

    The optional session_expires setting can also be passed, which will
    provide the duration time of the cookie. If it's not present, the cookie
    won't have an expiration value.

    Here is an example configuration to use in your config.yml:

        session: "cookie"
        session_cookie_key: "kjsdf07234hjf0sdkflj12*&(@*jk"
        session_expires: 1 hour

    Compromising session_cookie_key will disclose session data to clients
    and proxies or eavesdroppers and will also allow tampering, for example
    session theft. So, your config.yml should be kept at least as secure as
    your database passwords or even more.

    Also, changing session_cookie_key will have an effect of immediate
    invalidation of all sessions issued with the old value of key.

    session_cookie_path can be used to control the path of the session
    cookie. The default is /.

    The global session_secure setting is honoured and a secure (https only)
    cookie will be used if set.

DEPENDENCY
    This module depends on Session::Storage::Secure. Legacy support is
    provided using Crypt::CBC, Crypt::Rijndael, String::CRC32, Storable and
    MIME::Base64.

SEE ALSO
    See Dancer::Session for details about session usage in route handlers.

    See Plack::Middleware::Session::Cookie,
    Catalyst::Plugin::CookiedSession, "session" in Mojolicious::Controller
    for alternative implementation of this mechanism.

