PerlDancer/Dancer-Plugin-Auth-Twitter — pull request #13 by garu (2014-04-19 01:29:27+00:00)
Title: stringifies booleans to keep session storages happy

Hi there! I'm trying to use the plugin but, when Twitter tries to get back to my app, Dancer crashes and I get the following message:

error @0.471581> request to GET /auth/twitter/callback crashed: Encoding error:
Attempted to serialize blessed reference. Serializing objects using Sereal::Encoder
was explicitly disabled using the 'croak_on_bless' option. at (eval 395) line 12.
at Dancer/Session/Cookie.pm line 157. in Dancer/Handler.pm l. 98

I'm using Dancer::Session::Cookie as the session backend, in case it's not clear from the error message above :)

I have added a couple more debug messages on D:P:A:Twitter and found that the callback runs properly. The reason I'm creating the ticket here (instead of in Dancer::Session::Cookie's queue) is because I think the issue is that the session hash includes blessed objects from JSON::PP, like:

```perl
'follow_request_sent' => bless( do{\(my $o = 0)}, 'JSON::PP::Boolean' ),
'profile_use_background_image' => bless( do{\(my $o = 1)}, 'JSON::PP::Boolean'),
'notifications' => bless( do{\(my $o = 0)}, 'JSON::PP::Boolean' ),
'geo_enabled' => bless( do{\(my $o = 1)}, 'JSON::PP::Boolean' ),
...
```

Since this hash is supposed to be now a Perl hash, to be stored in the session data, I think it should not have blessed items after being created from $twitter->verify_credentials().

This pull request does exactly that: it stringifies those fields, which appear to be the only blessed fields returned by Twitter.

This solved the issue. For *me*. On my test user. Not sure if other items are returned on that hash depending on the user's profile.

I don't like this solution because, like I mentioned just above, it doesn't really scale. I wish there was an automatic way to deep traverse the session hash and unbless >everything that's a blessed boolean from Net::Twitter, or a way to let Net::Twitter (or the JSON backend) know that it should stringify booleans automatically for us. Is there?

Or is it something that the session storage should handle, not D:P:A:Twitter? My session backend, Dancer::Session::Cookie, uses Session::Storage::Secure which uses Sereal to serialize data and sets it up to die if trying to serialize blessed objects. According to Session::Storage::Secure's documentation:

Objects not stored

Session data may not include objects. Sereal is configured to die if objects
are encountered because object serialization/deserialiation can have undesirable
side effects. Applications should take steps to deflate/inflate objects before storing
them in session data.

If this is the case, then it shouldn't matter the session backend: instead, it should be Dancer::Plugin::Auth::Twitter's responsibility to avoid sending blessed data to the session storage.

Hope this helps!

/cc @dagolden