PerlDancer/Dancer-Session-Cookie — pull request #1 by garu (2014-05-15 23:12:32+00:00)
Title: let user store objects in the session

Hi there!

I've been talking to @dagolden regarding storing objects in sessions, which ended up becoming an option in Session::Storage::Secure 0.010. This patch attempts to push this update to Dancer::Session::Cookie by creating the Sereal Encoder/Decoder without the 'croak_on_blessed' option.

By default, Session::Storage::Secure does not allow storing objects due to concerns of action-at-a-distance. This is because, as Sereal::Encoder's documentation puts it, blessed references can mean executing a destructor on a remote system or generally executing code based on data. In a web application, however, it is very common to store JSON data in sessions (like when handling oauth from third-party providers). The Perl implementation of JSON creates thin "JSON::bool" objects to make the 1/true 0/false relationship between JSON data and Perl data structures, but you can't store it in Dancer::Session::Cookie because it doesn't allow objects. Besides, since session handling is performed by the developer, it should be the developer's responsibility to either store objects or not on the session structure.

Hopefully, if accepted, this patch will fix the issues above :)

Please let me know if you have any questions, issues or comments, of if there is anyway I can improve it so it is accepted upstream. Thanks!