title: Perl web-service (server) best practices
body: <p>I'm currently using a modified <a href="http://search.cpan.org/perldoc/HTTP::Daemon::Threaded" rel="nofollow noreferrer">HTTP::Daemon::Threaded</a> server in
  combination with SOAP::WSDL and <a href="http://search.cpan.org/perldoc/Pod::WSDL" rel="nofollow noreferrer">Pod::WSDL</a> to provide web services
  used by a variety of client types and roles.</p>
  
  <p>---- that's not the question, the following is -----</p>
  
  <p>I'd like to arrive at an optimal solution (as far as is possible) with respect to the following topics:</p>
  
  <ul>
  <li>Request/Dispatch/Response speed</li>
  <li>Protocol security (proper use of client-authenticated SSLv3/TLS)</li>
  <li>Resource security (security roles/traits on per-resource &amp; per-method bases)</li>
  <li>Declarative specification of types, method signatures, and required security roles &amp; traits.</li>
  </ul>
  
  <p>Questions:</p>
  
  <ol>
  <li><p>I'd like to be using an <a href="http://search.cpan.org/perldoc/IO::Select" rel="nofollow noreferrer">IO::Select</a> or <a href="http://search.cpan.org/perldoc/IO::Async::Loop::IO_Ppoll" rel="nofollow noreferrer">IO::Async::Loop::IO_Ppoll</a> -based server, but I understand that this is not compatible with in-server client authenticated SSL. <strong>Is my understanding correct?</strong></p></li>
  <li><p>I'd like to move away from verifying the client certificate on each request, to something like CA SiteMinder, where I give out a time-limited session cookie after successful client certificate verification, which can be used on subsequent requests to avoid this time penalty (and to lessen server load). <strong>Is this going to be as secure?</strong> (or even good enough?)</p></li>
  <li><p>Is there some module/framework I can build on to provided Trait and Role -based Authorisation for the exposed object and methods. Pod::WSDL really only deals with types (and not even complex ones). I'd like to use/implement some declarative annotation (or external YAML) -based scheme to handle complex WSDL typing as well as Trait &amp; Role Authorisation. <strong>Has anyone done this?</strong> (even separately?) <strong>Are there any other modules which might be a good starting point?</strong></p></li>
  <li><p>Finally - <strong>Am I just crazy for doing this in Perl5 ?</strong> ;)</p></li>
  </ol>