Tying a session to a domain

Hi,

I'd like to be able to tie a session to the domain it originated from. E.g. if a user accesses an app using domain1.com (subsequently generating a session for that site), and then uses domain2.com to access the same site but using the cookie from domain1.com, I'd like that to fail.

The reason is that I am hosting multiple sites at the same app, and would like to prevent "strange" behaviour that results in the above (e.g. a user from the wrong site is returned when using Plugin::Auth::Extensible)

The best way I can see to do this would be to add an additional domain parameter to _flush and _retrieve in Dancer2::Core::Role::SessionFactory, and then (optionally) set and check the domain when interacting with sessions.

I've got most of the above working as a proof of concept, but it's occurred to me that it's quite a big change. So, I'd just like to request some feedback, before I spend any more time on this.

Thanks,

Andy

Start by reviewing Dancer2::Core::Role::SessionFactory, especially the _flush and _retrieve entry points, and inspect how Plugin::Auth::Extensible uses sessions. Done means the design can associate a session with its originating domain and reject reuse from another hosted domain without breaking existing session behavior.