The Perl Toolchain Summit needs more sponsors. If your company depends on Perl, please support this very important event.
 / 
Catalyst-Controller-RequestToken-0.01
River stage zero No dependents
++
/ Catalyst::Controller::RequestToken

NAME

Catalyst::Controller::RequestToken - Handling transaction token across forms

SYNOPSIS

requires Catalyst::Plugin::Session module, in your application class:

    use Catalyst qw/
        Session
        Session::State::Cookie
        Session::Store::FastMmap
        FillForm
     /;

in your controller class:

    use base qw(Catalyst::Controller::RequestToken);
    
    sub form :Local {
        my ($self, $c) = @_;
        $c->stash->{template} = 'form.tt';
        $c->forward($c->view('TT'));
    }
    
    sub confirm :Local :CreateToken {
        my ($self, $c) = @_;
        $c->stash->{template} = 'confirm.tt';
        $c->forward($c->view('TT'));
    }
    
    sub complete :Local :ValidateToken {
        my ($self, $c) = @_;
        if ($self->validate_token) {
            $c->response->body('complete.');
        } eles {
            $c->response->body('invalid operation.');
        }    
    }

form.tt

    <html>
    <body>
    <form action="confirm" method="post">
    <input type="submit" name="submit" value="confirm"/>
    </form>
    </body>
    </html>

confirm.tt

    <html>
    <body>
    <form action="complete" method="post">
    <input type="hidden" name="_token" values="[% c.req.param('_token') %]"/>
    <input type="submit" name="submit" value="complete"/>
    </form>
    </body>
    </html>

DESCRIPTION

This controller enables to enforcing a single transaction across multi forms. Using token, you can prevent duplicate submits, or protect from CSRF atack.

This module REQUIRES Catalyst::Plugin::Session to store server side token.

If you add CreateToken attribute to action, token will be created and stored into request and session. You can return a content with request token which should be posted to server.

If you add ValidateToken attribute, this will validate request token with sever-side session token, and remove token from session.

After ValidateToken, there is any token in session, so validation will be failed, if user request with expired token.

METHODS

validate_token

Return token is valid or not. This will work collectlly only after ValidateToken.

CONFIGRATION

in your application class:

    __PACKAGE__->config('Controller::RequestToken' => {
        session_name => '_token',
        request_name => '_token',
    });
session_name

Default: _token

request_name

Default: _token

INTERNAL METHODS

new
ACCEPT_CONTEXT

SEE ALSO

Catalyst::Controller::RequestToken::Action::CreateToken Catalyst::Controller::RequestToken::Action::ValidateToken Catalyst Catalyst::Controller Catalyst::Plugin::Session Catalyst::Plugin::FormValidator::Simple

AUTHOR

Hideo Kimura <<hide@hide-k.net>>

COPYRIGHT

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

The full text of the license can be found in the LICENSE file included with this module.