Code Index:

package Catalyst::Plugin::RequestToken
__END__
EOF

NAME

Catalyst::Plugin::RequestToken - (DEPRECATED) Handling transaction token for Catalyst

DEPRECATION NOTICE

This module has been deprecated in favor of Catalyst::Controller::RequestToken. Please do not use it in new code. It has known compatibility issues and is absolutely not supported by anyone. It remains only in case you have existing code that relies on it.

SYNOPSIS

in your application class:

    use Catalyst qw/
        Session
        Session::State::Cookie
        Session::Store::FastMmap
        RequestToken 
        FillInForm
    /;

in your contoller class:

    sub input : Local {
        my ( $self, $c ) = @_;

        $c->stash->{template} = 'input.tt';
        $c->forward($c->view('TT'));
    }

    sub confirm : Local {
        my ( $self, $c ) = @_;

        $c->create_token;
        $c->stash->{template} = 'confirm.tt';
        $c->forward($c->view('TT'));
        $c->fillform;
    }

    sub complete : Local {
        my ( $self, $c ) = @_;

        if ($c->validate_token) {
            $c->res->output('Complete');
        } else {
            $c->res->output('Invalid Token');
        }
        $c->remove_token;
    }

root/input.tt TT template:

    <html>
    <body>
    <form action="confirm" method="post">
    <input type="submit" name="submit" value="confirm"/>
    </form>
    </body>
    </html>

root/confirm.tt TT template:

    <html>
    <body>
    <form action="complete" method="post">
    <input type="hidden" name="token"/>
    <input type="submit" name="submit" value="complete"/>
    </form>
    </body>
    </html>

or you can call prepare_token instead of a bunch of methods. And you don't have to write '<input type="hidden" name="token"... >' for token in your template.

    sub input : Local {
        my ( $self, $c ) = @_;

        $c->stash->{template} = 'input.tt';
        $c->prepare_token;
    }

if you loaded Catalyst::Plugin::FormValidator::Simple and fail to validate token, C::P::FormValidator::Simple->set_invalid_form will call automatically in validate_token method (constraint name is 'TOKEN').

    sub complete : Local {
        my ( $self, $c ) = @_;

        $c->form(
            name => [qw/NOT_BLANK ASCII/]
            ...
        );

        $c->validate_token;

        my $result = $c->form;

        if ( $result->has_error) {
            $c->res->body('Error');
        } else {
            $c->res->body('Success');
        }
    }

DESCRIPTION

This plugin create, remove and validate transaction token, to be used for enforcing a single request for some transaction, for exapmle, you can prevent duplicate submits.

Note: REQUIRES a session plugin like Catalyst::Plugin::Session to store server side token.

METHODS

prepare_token: automatically append token hidden tag to response body.
create_token: Create new token, it uses SHA-1, MD5 or SHA-256, depending on the availibility of these modules.
remove_token: Remove token from server side session.
validate_token: Validate token.

AUTHOR

Hideo Kimura <<hide@hide-k.net>>

LICENSE

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

The full text of the license can be found in the LICENSE file included with this module.