How do I design a Perl cookie initialization login screen?

Question

Guys, Based on this question I asked earlier on setting up cookies in Perl, I successfully got an answer and way to do this but am now faced with a new interesting challenge.

In Perl CGI scripts, it demands you setup a cookie on the header statement which ought to be the first statement in your script. To clarify, you need to have a CGI->header() statement at the top of your script for the CGI script to work!

My scenario:

I have a login screen with a user name and password, upon successful login I need to setup a cookie with the current user name, then redirect the user to another form that checks if the cookie is set before allowing any transactions.

Please note if I set the cookie after the CGI->header() statement, it never get set, and if I set it at the top of my script, it has a bogus value for obvious reasons (user has not logged in)

How do I achieve this? does the CGI->header() statement need to be at the top of my script always?

Gath

Answer 1

Your assertion is wrong: print CGI->header can appear anywhere in your script. However, headers must be output once and only once and before any other output is emitted.

For your purposes, I would recommend using CGI::Application along with CGI::Session (via CGI::Application::Plugin::Session).

Answer 2

You're gonna end up writing yourself some code that can be hijacked if you keep heading in that direction, given your current level of knowledge ("just enough to be dangerous").

I'd suggest reading my article on how to "brand" a browser using cookies. It's an oldie-but-a-goodie.

For the impatient, the trick is to use a cookie only to distinguish one browser from another, and keep everything important as server-side state.