Session not correct after coming back from a third party site

Question

Everything is working fine if all the processing happens on my own site. The session variable get stored and retrieved successfully.

Now I got a third part integration, which is processed via POST data. I have got session_start() called at the first line of each php file.

• start_process.php - sets some session variables as follows and calls third party that redirects to response.php

   $_SESSION["id"] = $id       // Echoing these shows the correct values 
   $_SESSION["name"]= $name    // Echoing these shows the correct values 
  

• response.php - This page receives the response from the third party and tries to get the data from session variables

   $id = $_SESSION["id"]           // This comes out to be blank
   $name = $_SESSION["name"]       // This comes out to be blank
  

On my processing page i.e. the response.php, I am trying to retreive back the session values, I don't get the session variables back.

Searching on SO, few post suggest that to check the value of

echo session_id();

which comes to be as different on the first page and the later page coming back to my site. Searching further shows that the value of the following needs to be blank

echo ini_get('session.cookie_domain');

This indeed is blank. Now I am stuck as I see this value as blank, and even though the session is not getting loaded properly.

Can you please suggest what to do next? Any debugging? Any hints to solve this problem?

---

Update

start_process.php

has a form whose post action is the url to third party site... as

<?php session_start(); 
$_SESSION["Check"] = "Abc";
echo session_id();
>
<form name="myform" action="http://<ThirdPartyUrl.com>/pathToSomePage.jsp" method="POST">
          <!-- some  hidden fields with value  and some other text fields -->
</form>

respone.php

The third party gives a response in post request again to my response page where I directly test the output of the POST variables and here I am trying to use my session variables

<?php session_start(); 
echo $_SESSION["Check"];
echo session_id(); // This is different from the one printed in the start_process.php page
?>

I don't think the third party hosting is on the same server, because currently I am on a shared host and the third party definitely has it's own server.

Answer 1

It's hard to know without seeing some more code (how start_process.php is hooking into the third-party code, how the third-party is coming back to response.php). Here are a couple guesses:

Theory 1: third-party code is messing with your session (if hosted on the same server)

Is this third-party integration hosted on your same server? If so, I would suspect that the third-party could be ending/recreating, or otherwise modifying your session.

Theory 2: third-party is redirecting back to your site using a separate domain

Is it possible that you start off at mydomain.com and the third-party redirects back to www.mydomain.com (or something like that)? Even though those two domains look like they should be the same, they are utterly different as far as PHP sessions are concerned, you'll end up with a different session.