session variables set but return blank

Question

I am trying to create a login flow but having problems setting the session variable,

when the user hits the page, i have a php document check to see if the user is logged in or if there are cookies set to re-log them in,

the code (simplified) to check is:

 <?php
session_start();

if (isset($_SESSION['uid'])) {
//logged in experience here
}   
else {

if (isset($_COOKIE['uname']) && isset($_COOKIE['key'])) {

                        //query database to ensure valid credentials

          if (<--valid-->){
          $_SESSION['uid'] = $uid; //set session variables
           $_SESSION['fname'] = $fname;
           var_dump($_SESSION);  //check to make sure variables set, this works
           //logged in experience
           }
           else {
                echo "error loggin in";
            }   

}

}


?>

on the first hit on the page, if session isnt set it goes to the cookies and then it sets the session variables. on the index page i print_r the session variables and i get the desired result, after navigating away from the page and then back using text links within the same subdomain the php is called again and this time the $_SESSION['uid'] is set however it is returned as blank as shown by the print_r.

So the problem is, somewhere between navigating away to a page that doesn't currently touch the session and then back the variable gets set to blank. I have also tested this by going to a page that does touch the session variables, it simply sets a session variable as a uniqid for me to track, and that variable is able to be recalled on the index page. Also, session_start() is called at the top of the index page as well,

the php on the index is simply

<?php
session_start();
require 'login_check.php';
print_r($_SESSION);
?>

Answer 1

Spitballin

• Remove any whitespace before <?php in the file you include (which in this case is login_check.php)

• Put this before session_start() to keep the cookie from disappearing unexpectedly

  session_set_cookie_params(0);
  

• If that doesn't help, you should try passing your SID (session ID) around your URLs and see if that helps. If you have session.use_trans_sid enabled in your php.ini file and your PHP installation was compiled with the configuration --enable-trans-id then the SID will be included in the URLs by default. Check this page out for more information.

• Remove the unnecessary session_start() from the login_check.php since its already called on the originating page.