title: Are there flaws in my web session handling process?
body: <p>Okay so the way this works is the user authenticates via web form and generates a session ID as so:</p>
  
  <pre><code>sub session_open
  {
      my $sid;
      my $user = shift;
  
      if ( open(SEMA, "&gt; ../sema/sess") )
      {
          flock SEMA, LOCK_EX;
          do 
          {
              $sid = generate_session_id();
          } 
          while ( -d "$SDIR/$sid" );
          my $sstr = "$user:$ENV{'HTTP_USER_AGENT'}";
          write_file('&gt;', "$SDIR/$sid", $sstr);
          close SEMA;
      }
  
      return $sid;
  }
  </code></pre>
  
  <p>The session ID is then passed to every page in the url, if the session file exists and checks out against his user agent and remote addr it allows the user to continue:</p>
  
  <pre><code>sub check_sid
  {   
      my $sid = shift;
       return 0 if $sid =~ /[^\w\d]/;
      return 0 if !open(SID, "&lt; $SDIR/$pid");
      my ($user, $agent) = split /:/, &lt;SID&gt;, 2;
      close SID;
      return 0 if $agent ne $ENV{'HTTP_USER_AGENT'}";
      return $user;
  }
  </code></pre>
  
  <p>In the background I have a cron job running a script every 5 minutes expiring sessions 2 hours old:</p>
  
  <pre><code>foreach (&lt;../session/*&gt;)
  {
      unlink $_ if -M $_ &gt; 0.08333;
  }
  </code></pre>
  
  <p>Are there any flaws, unnecessary steps I am taking here? I figured use the user_agent and remote_addr as it would be harder to jack someones session ID that way.</p>