Perl session

#! /usr/local/bin/perl

use strict;
use warnings;

# 環境依存
use lib "$ENV{DOCUMENT_ROOT}/lib/perl5";
use lib "$ENV{DOCUMENT_ROOT}/lib";
use lib "./lib";

use CGI qw|:standard|;
use CGI::Session;
use Password;

my $title = "セッションID管理テスト";
my $expire = "+1h";
my $encode = "UTF-8";

# データベースを使うところを省略
my %User ('hoge'=> {pass => q|$1$hEeN3T%+$CRKHRxko1cWGNjE69mTNw.|});

my $cgi = new CGI;
print $cgi->redirect( -uri=>'http://'.$ENV{SERVER_NAME}.$ENV{SCRIPT_NAME}, -status=>301) and exit if $cgi->param('CGISSID');

my $sid = $cgi->cookie('CGISESSID') || undef;

my $session = CGI::Session->load(undef, $sid, {Directory=>'./data'}) or die CGI:Session->errstr();
Error("Your session time out! Refresh the screen to start new session!") if $session->is_expired;
$session->expire($expire); #有効期限の設定
#$session->expire('+1m');

if($session-> is_empty){
	$session = $session->new(undef, $sid, {Directory=>'./data'}) or die $session->errstr;
} #取得したセッションidが有効ならそのまま、無効なら別のidを発番

my %param = $cgi->Vars();
my @message;

if ($session){
	if (my $action = $param{'action'}){
		push @message, forget() if $action eq 'forget me'; #　セッションの削除依頼
		push @message, loguout() if $action eq 'logout';  #　セッション内のログインステータスを初期化
	}

	$session->save_param($cgi); # 入力値をセッション内に保存
	$session->clear('pass'); #パスワードの平文保存を回避
	push @message, login($session->param('username'), $param{'pass'}) if $param{'action'} and $param{'action'} eq 'login';
	push @message, $session->param('username')? confirm(): ask();
} else {
	push @message, ask();
}

print $session->header ( -charset => $encode),
	start_html( -title => $title, -encoding => $encode, -lang=>'ja'),
	@message,
	a({href=>$ENV{"SCRIPT_NAME"}}, '戻る',),
	end_html(),
;

sub Error {
	my $msg = shift;

	print $session->header( -charset => encode),
	start_html( -title => "エラー / " . $title, -encoding => $encode, -lang => 'ja'),
	h1("エラー"),hr();
	p(strong($msg)),hr(),
	a({href=>$ENV{"SCRIPT_NAME"}}, '戻る',),
	end_html(),
};
exit;
}

sub forget {
	$session->clear(['username','firstname','lastname','like','action','login']);
	$session->close;
	$session->delete;
	return h2("we've forgotten you!");
}