Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Web Applications

|

355

Perl

The Apache::Session module provides session functions for mod_perl. The session ID

can be saved in a cookie or manually appended to URLs. Session storage may use the

filesystem, a database, or RAM. See the documentation at http://www.perldoc.com/

cpan/Apache/Session.html.

Apache provides its own language-independent session management with mod_ ses-

sion. This works with or without cookies (by appending the session ID to the URL in

the

QUERY_STRING environment variable) and can exempt certain URLs, file types, and

clients from session control.

Site Management: Uploading Files

As you update your web site, you will be editing and copying files. You may also

allow customers to upload files for some purposes. How can you do this securely?

Tim Berners-Lee originally envisioned the Web as a two-way medium, where brows-

ers could easily be authors. Unfortunately, as the Web commercialized, the empha-

sis was placed on browsing. Even today, the return path is somewhat awkward, and

the issue of secure site management is not often discussed.

Not-so-good ideas

I mentioned form-based file uploads earlier. Although you can use this for site main-

tenance, it handles only one file at a time and forces you to choose it from a list or

type its name.

Although FTP is readily available ...