Properly using session_set_cookie_params

Question

I am trying to implement a login system with a 'remember me' feature . This is my my login page: http://pastebin.com/q6iK0Mgy . In this I am trying to extend the session cookie(PHPSESSIONID) expiration using session_set_cookie_params() . But its not working.

Relevant portion from the code: In this the inner if() loop is being executed , but session_set_cookie_params('3600') is having no effect. I am calling session_name() , as it is supposed to be a requirement for session_set_cookie_params() (according to one of the comments on php manual)

if ( isset($_POST["submit"]) ) 
 {
     session_name() ;
     echo "calling before checked " ;
     if ( $_POST["remember"] == "on") 
    {
       // extend expiration date of cookie
       session_set_cookie_params('3600');
       echo "<br/>calling after sessions_set_cookie_params" ;
    }
 } 
 require_once("includes/session.php"); //session start ?>

I hope I was able to explain what I want to do. Basically what I a trying to do is extend the session_cookie's expiration. is my way of doing completely wrong? is there another way to achieve the same ?

thanks

Answer 1

Never too old for an answer right?

So, PHP is dumb. As in, it doesn't do what you think would make sense.

session_set_cookie_param will not do anything until the exact moment that you call session_start. So if you set cookie params after calling session start, too late. If you set the cookie params but then don't call session_start, nothing happens.

session_start is also a funny beast. It only reads cookie data the first time it is called -well that is unless.... you force it to write, or there is no cookie to begin with. So if there is no cookie, it writes the cookie data and the client saves your session. yay! But when the cookie exists already, how to we force it to write, and therefore update our new expiry date??

So, we have this odd effect of ignoring all of your session_set_cookie_param calls if a cookie already exists on the client. Even better, if you explicitly call setcookie(session_name(),blah blah blah), php will STILL not emit the cookie.

So, let's force php to emit a cookie.

option 1

This works by calling session_id with the only value that won't clobber your existing session. Documentation at http://php.net/session_id states that

Note: When using session cookies, specifying an id for session_id() will always send a new cookie when session_start() is called, regardless if the current session id is identical to the one being set.

session_id($_COOKIE[session_name()]);

So anyways it's 6 in the morning and I haven't slept yet and you probably figured this out months if not years ago, but what the hell, maybe i'll save someone else the 2 or 3 hours of my life i'll never get back. ha ha.