kraih/mojo — pull request #257 by nwatkiss (2011-12-27 20:18:25+00:00)
Title: Add support for HttpOnly and non-expiring Mojolicious::Sessions cookies

The documentation/code implies that non-expiring sessions are supported; but that doesn't really work today. This branch implements the required changes, all to lib/Mojolicious/Sessions.pm:

- Allow $app->sessions->default_expiration(0) to mean "don't expire cookies", rather than the current "set the expiry to now (just expired)". When default_expiration is 0, sessions do not contain the expires key, and the cookies do not get an Expires attribute. Incoming session cookies do not require an 'expires' key, but if it is present and expired, the cookie is still treated as expired.
- Add logic to avoid issuing superfluous Set-Cookie headers for cookies whose values have not changed. This issue is only relevant for non-expiring cookies, since previously each request would have incremented the expires key.
- This patch also allows setting the HttpOnly attribute on the underlying session cookies. For newly-created web applications, this is current best practise, so it should be easy. It should probably default to 1, but I tried to stay backward-compatible.