PHP Session Id changes between pages

Question

I have a problem where i am losing the PHP session between 2 pages.

The session_start() is included in a file called session-inc.php into every page requiring a session to be set. This works for all pages on the site except one particular page, member-profile.php. When this page is visited a new session with a different id (same session name) is set and used instead.

A few more details:

• Session name is set manually
• All pages are on the same server under the same domain name
• If i put an additional session_start() above the include('session-inc.php') in the member-profile.php file, the session is carried over correctly
• I have tried setting the session_cookie_domain and session.session_name in the .htaccess, this worked for this domain but it stopped the session being passed over to out payment domain
• We are running apache 2.2.6 with php 5.2.5

Putting the session_start() above the include('session-inc.php') in the member-profile.php file is the quick and dirty fix for this problem, but i am wondering if anybody know why this would be happening.

Cheers

Will

Answer 1

I just spent all day diagnosing this issue in my Ionic3 - to - PHP project. TL; DR - make sure your client is actually sending session credentials.

In the interest of helping anyone who makes this mistake, I will share how I found the problem. I used these tools to diagnose the session on both the client and server:

1) Add a test file with phpinfo() to the server to review PHP session options.

2) Review the PHP code to make sure that no output, intentional or un-intentional occurs before the session_start() line. Check the status bar of Visual Studio Code to make sure the Byte Order Mark (BOM) is absent from the PHP files.

3) Review server PHP logs (in /var/log/nginx/error.log for me). Add error_log() lines to the php file to dump the session_id() or $_SESSION array.

4) Use tcpdump -An 'port 80 or port 443' to view the actual HTTP requests and replies. (That's where I discovered the missing cookies).

For an Ionic3 data provider the correct syntax for the client is:

    var obsHttp = this.http.post(url, body,
  { headers: new HttpHeaders({
    'Content-Type':'application/x-www-form-urlencoded'
  }),withCredentials: true }).timeout(this.timeoutTime);

Notice the withCrentials:true One needs to call subscribe on the obsHttp() observable to send the request.

Answer 2

I have just encountered this problem. Interestingly, browsing via http://127.0.0.1 instead of http://localhost helped me.