sending session cookie before redirect

**Gary Petersen** · Jul 16 '05, 11:44 PM

Re: sending session cookie before redirect

A Martian named "Jochen Daum" <jochen.daum@ca ns.co.nz> telepathically
imparted message <pn5glvklapkk1d bdqrqfm7h5edbq7 hq9vp@4ax.com> to us on
Thu, 04 Sep 2003 23:57:35 -0500:
[color=blue]
> Hi!
>
> I have a function in a lot of pages, which redirects to a new page, if a
> form has been submitted:
>
> if (!(defined("DEB UG_INSERT") && DEBUG_INSERT) &&
> !(defined("DEBU G_UPDATE") && DEBUG_UPDATE) &&
> !(defined("DEBU G_SELECT") && DEBUG_SELECT)){
> if ($_POST){
> $_SESSION["postvalue"] = $_POST;
> header("HTTP/1.1 302 Moved Temporarily");
> header ("Location: ".BASE_URL.$ses s->assemble(),tru e, 302);
> header("Connect ion: close");
> exit();
> }else{
> if (isset($_SESSIO N["postvalue"])){
> $_POST = $_SESSION["postvalue"];
> }
> }
> }
> }
> In conjunction with a login form and a browser that accepts cookies for
> the session handling, this leads to everyone having to enter his login
> and pasword twice.
>
> i believe this is, because the cookie do not get sent before the header
> ("Location:
> Has anyone an idea how to force this or send them by hand?
>
> Cheers, Jochen[/color]

Keep it simple:

session_start() ;
if (!isset($_SESSI ON['postvalue'])):
header ("HTTP/1.1 302 Moved Temporarily to Singapore");
header ("Location: http://myhost.com/login.php");
exit();
endif;
$_POST = $_SESSION['postvalue'];
// show the page

BTW, is there any reason that you just *have* to
use $_POST for all the pages? $_POST is only needed to
retrieve the variables from the (login?) form. After that,
you are free to do everything in $_SESSION['postvalue'].

The "to Singapore" part is just a jest. Don't include it :D

**Jochen Daum** · Jul 16 '05, 11:44 PM

Re: sending session cookie before redirect

HI Gary!

On Sun, 07 Sep 2003 09:31:51 GMT, Gary Petersen
<garyp1492@REMO VE.MEearthlink. INVALID> wrote:
[color=blue]
>A Martian named "Jochen Daum" <jochen.daum@ca ns.co.nz> telepathically
>imparted message <pn5glvklapkk1d bdqrqfm7h5edbq7 hq9vp@4ax.com> to us on
>Thu, 04 Sep 2003 23:57:35 -0500:
>[color=green]
>> Hi!
>>
>> I have a function in a lot of pages, which redirects to a new page, if a
>> form has been submitted:
>>
>> if (!(defined("DEB UG_INSERT") && DEBUG_INSERT) &&
>> !(defined("DEBU G_UPDATE") && DEBUG_UPDATE) &&
>> !(defined("DEBU G_SELECT") && DEBUG_SELECT)){
>> if ($_POST){
>> $_SESSION["postvalue"] = $_POST;
>> header("HTTP/1.1 302 Moved Temporarily");
>> header ("Location: ".BASE_URL.$ses s->assemble(),tru e, 302);
>> header("Connect ion: close");
>> exit();
>> }else{
>> if (isset($_SESSIO N["postvalue"])){
>> $_POST = $_SESSION["postvalue"];
>> }
>> }
>> }
>> }
>> In conjunction with a login form and a browser that accepts cookies for
>> the session handling, this leads to everyone having to enter his login
>> and pasword twice.
>>
>> i believe this is, because the cookie do not get sent before the header
>> ("Location:
>> Has anyone an idea how to force this or send them by hand?
>>
>> Cheers, Jochen[/color]
>
>Keep it simple:
>
>session_start( );
>if (!isset($_SESSI ON['postvalue'])):
> header ("HTTP/1.1 302 Moved Temporarily to Singapore");
> header ("Location: http://myhost.com/login.php");
> exit();
>endif;
>$_POST = $_SESSION['postvalue'];
>// show the page
>[/color]

How does the value of all form fields get into $_SESSION?[color=blue]
>
>BTW, is there any reason that you just *have* to
>use $_POST for all the pages? $_POST is only needed to
>retrieve the variables from the (login?) form.[/color]

No. I have eg. a form on nearly every page to change filters of the
data displayed etc.

Jochen
--
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.
http://sourceforge.net/projects/phpdbedittk/

**Gerhard Fiedler** · Jul 16 '05, 11:44 PM

Re: sending session cookie before redirect

On Sun, 07 Sep 2003 21:56:31 +1200, Jochen Daum wrote:
[color=blue]
>How does the value of all form fields get into $_SESSION?[/color]

you have to put it there, by simple assignment:

$_SESSION['parameter'] = $_POST['parameter'];

or something to that effect.

**Jochen Daum** · Jul 16 '05, 11:44 PM

Re: sending session cookie before redirect

Hi Gerhard!

On Sun, 07 Sep 2003 12:16:26 -0700, Gerhard Fiedler
<nospam@globo.c om.REMOVE> wrote:
[color=blue]
>On Sun, 07 Sep 2003 21:56:31 +1200, Jochen Daum wrote:
>[color=green]
>>How does the value of all form fields get into $_SESSION?[/color]
>
>you have to put it there, by simple assignment:
>
>$_SESSION['parameter'] = $_POST['parameter'];
>[/color]
Well, I understand that. That's why I had it there in the original
post.

Any suggestions for my orginal problem?

Jochen
--
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.
http://sourceforge.net/projects/phpdbedittk/

**Gary Petersen** · Jul 16 '05, 11:44 PM

Re: sending session cookie before redirect

A horsie named Jochen Daum demonstrated surprising intellligence and
its ability to use morse code on Sun, 07 Sep 2003 04:56:31 -0500 when
it tapped <9uvllv4chirgsi 5u71l6anah930bk 2v78f@4ax.com> with its hoof:
[color=blue]
> HI Gary!
>[/color]

Hi Jochen!
[color=blue]
> On Sun, 07 Sep 2003 09:31:51 GMT, Gary Petersen
> <garyp1492@REMO VE.MEearthlink. INVALID> wrote:
>[color=green]
>> [...]
>>Keep it simple:
>>
>>session_start ();
>>if (!isset($_SESSI ON['postvalue'])):
>> header ("HTTP/1.1 302 Moved Temporarily to Singapore");
>> header ("Location: http://myhost.com/login.php");
>> exit();
>>endif;
>>$_POST = $_SESSION['postvalue'];
>>// show the page
>>[/color]
>
> How does the value of all form fields get into $_SESSION?[/color]

The login.php page should present a username/password form
to the user. When the user submits the form, the form's data
would go to a process_login.p hp page. If the username and
password are correct, process_login.p hp would put all of
the necessary data into $_SESSION['postvalue']. The password
does not need to be stored in the session.
[color=blue][color=green]
>>
>>BTW, is there any reason that you just *have* to
>>use $_POST for all the pages? $_POST is only needed to
>>retrieve the variables from the (login?) form.[/color]
>
> No. I have eg. a form on nearly every page to change filters of the
> data displayed etc.
>[/color]

To make my life easier, I would do this:
if (isset($_POST['somevariable'])) {
$_SESSION['displayform'] = $_POST;
$disp = & $_SESSION['displayform'];
}

Then I would use $disp for everything on the page.
"Somevariab le" is just any variable that you can use
to make sure that the form variables are there.
Good luck.

PS.
Unless you are running on a dedicated server, sessions
are not all that secure.

**Gerhard Fiedler** · Jul 16 '05, 11:44 PM

Re: sending session cookie before redirect

On Mon, 08 Sep 2003 07:41:24 +1200, Jochen Daum wrote:
[color=blue]
>Well, I understand that. That's why I had it there in the original
>post.[/color]

I only looked at the post I answered to... :-/
[color=blue]
>Any suggestions for my orginal problem?[/color]

It seems Gary answered. But for more, I guess some more code would be
necessary. At first sight (without actually testing it) there seems
nothing wrong with your code.

You say that you do something with cookies -- but there's no cookie
code in what you posted. You can look at the cookie (at the client),
and you can also look at the headers that get exchanged (use something
like Proxomitron) to make sure they do what you want them to do.

You can also dump your postvalue and _POST arrays at various points to
make sure they contain what you expect them to contain. That should
get you closer to the point where things start to diverge from what
you think they should do.

**Jochen Daum** · Jul 16 '05, 11:44 PM

Re: sending session cookie before redirect

Hi Gary!

....[color=blue][color=green]
>>[color=darkred]
>>> [...]
>>>Keep it simple:
>>>
>>>session_star t();
>>>if (!isset($_SESSI ON['postvalue'])):
>>> header ("HTTP/1.1 302 Moved Temporarily to Singapore");
>>> header ("Location: http://myhost.com/login.php");
>>> exit();
>>>endif;
>>>$_POST = $_SESSION['postvalue'];
>>>// show the page
>>>[/color]
>>
>> How does the value of all form fields get into $_SESSION?[/color]
>
>The login.php page should present a username/password form
>to the user. When the user submits the form, the form's data
>would go to a process_login.p hp page. If the username and
>password are correct, process_login.p hp would put all of
>the necessary data into $_SESSION['postvalue']. The password
>does not need to be stored in the session.
>[/color]
Sorry, you misunderstand the problem slighly. The data stored in
postvalue is not the data from the login form, but from another form.
It should actually be all form data, that is sent by post in a whole
application (meaning a set of web pages). The problem is, that if I
run the function above (my original one) everytime there is a post
form (including the login), then the user gets prompted twice for the
password/username. This is IMO, because the cookie with the PHPSESSID
is not sent to the client browser, before the header ("Location" line.
I think it is like that, because
1.) it works fine, if I exclude the login form from the ones handled
by this function
2.) it works with browser denying all cookies.
[color=blue][color=green][color=darkred]
>>>
>>>BTW, is there any reason that you just *have* to
>>>use $_POST for all the pages? $_POST is only needed to
>>>retrieve the variables from the (login?) form.[/color]
>>
>> No. I have eg. a form on nearly every page to change filters of the
>> data displayed etc.
>>[/color]
>
>To make my life easier, I would do this:
>if (isset($_POST['somevariable'])) {
> $_SESSION['displayform'] = $_POST;
> $disp = & $_SESSION['displayform'];
>}
>
>Then I would use $disp for everything on the page.
>"Somevariabl e" is just any variable that you can use
>to make sure that the form variables are there.[/color]

I though of marking the login form with a hidden field, so that I can
recognise it, but I actually want the functionality also for the login
form. Its basically about usability against speed. The users don't
understand, what they have to do, if the browser asks them if they
want to resubmit the data. Thats why I redirect them to a GET request
everytime, so that the message doesn't come up.
[color=blue]
>PS.
>Unless you are running on a dedicated server, sessions
>are not all that secure.[/color]

I do.

Jochen

--
Jochen Daum - CANS Ltd.
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.
http://sourceforge.net/projects/phpdbedittk/

**Jochen Daum** · Jul 16 '05, 11:44 PM

Re: sending session cookie before redirect

Hi Gerhard,
[color=blue][color=green]
>>Any suggestions for my orginal problem?[/color]
>
>It seems Gary answered. But for more, I guess some more code would be
>necessary. At first sight (without actually testing it) there seems
>nothing wrong with your code.
>
>You say that you do something with cookies -- but there's no cookie
>code in what you posted. You can look at the cookie (at the client),
>and you can also look at the headers that get exchanged (use something
>like Proxomitron) to make sure they do what you want them to do.[/color]

When you use PHP sessions, a unique ID is transported to the browser
by a cookie, if the browser accepts it. AFAIK on the first request
there is always a cookie sent, and if it wasn't there and a session
has been started with the SID parameter in the URL none gets sent.

This is the cookie I'm talking about. My original problem is, that if
I run the original function on all pages, the user gets prompted twice
for username/password. This is IMO, because this cookie (for
successful login) is not sent through before the header command.[color=blue]
>
>You can also dump your postvalue and _POST arrays at various points to
>make sure they contain what you expect them to contain. That should
>get you closer to the point where things start to diverge from what
>you think they should do.[/color]

They seem to look fine. I'll have a closer look soon.

Jochen

--
Jochen Daum - CANS Ltd.
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.
http://sourceforge.net/projects/phpdbedittk/

**Gary Petersen** · Jul 16 '05, 11:44 PM

Re: sending session cookie before redirect

A horsie named Jochen Daum demonstrated surprising intellligence and its
ability to use morse code on Sun, 07 Sep 2003 23:35:14 -0500 when it
tapped <o11olvkld4jif6 uqt5stfdqm4k6je h98sd@4ax.com> with its hoof:
[color=blue]
> Hi Gary![/color]

Hi Jochen!
[color=blue]
> [...] everytime there is a post form
> (including the login), then the user gets prompted twice for the
> password/username. This is IMO, because the cookie with the PHPSESSID is
> not sent to the client browser, before the header ("Location" line. I
> think it is like that, because
> 1.) it works fine, if I exclude the login form from the ones handled by
> this function
> 2.) it works with browser denying all cookies.
> [...][/color]

Maybe you are not starting the session early enough on one
of your pages.

The session has to exist *before* the login process starts,
so if you have a login.php page that presents a login form to
the user, make sure that it starts the
session with session_start() -- right at the top of the page--
before the user gets to do anything (even log in). And then each
page in the system does the same, starting the session as
the first thing.

Separate the concept of a session from the concept of an
authenticated user. It's possible to have a session where
the user is un-authenticated, and it's possible to have a
session where the user is authenticated.

**Jochen Daum** · Jul 16 '05, 11:44 PM

Re: sending session cookie before redirect

Hi Gary!
On Mon, 08 Sep 2003 07:30:59 GMT, Gary Petersen
[color=blue][color=green]
>> [...] everytime there is a post form
>> (including the login), then the user gets prompted twice for the
>> password/username. This is IMO, because the cookie with the PHPSESSID is
>> not sent to the client browser, before the header ("Location" line. I
>> think it is like that, because
>> 1.) it works fine, if I exclude the login form from the ones handled by
>> this function
>> 2.) it works with browser denying all cookies.
>> [...][/color]
>
>Maybe you are not starting the session early enough on one
>of your pages.
>
>The session has to exist *before* the login process starts,
>so if you have a login.php page that presents a login form to
>the user, make sure that it starts the
>session with session_start() -- right at the top of the page--
>before the user gets to do anything (even log in). And then each
>page in the system does the same, starting the session as
>the first thing.[/color]

I just checked that. It always happens before anything else happens.
This is because my login class checks a parameter from my session
class, so the latter one has to be instantiated. And session_start is
in the constructor of that class.
[color=blue]
>
>Separate the concept of a session from the concept of an
>authenticate d user. It's possible to have a session where
>the user is un-authenticated, and it's possible to have a
>session where the user is authenticated.[/color]

yep.

Jochen

--
Jochen Daum - CANS Ltd.
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.
http://sourceforge.net/projects/phpdbedittk/

**Gerhard Fiedler** · Jul 16 '05, 11:44 PM

Re: sending session cookie before redirect

On Mon, 08 Sep 2003 16:40:00 +1200, Jochen Daum wrote:
[color=blue][color=green]
>>You say that you do something with cookies -- but there's no cookie
>>code in what you posted. You can look at the cookie (at the client),
>>and you can also look at the headers that get exchanged (use something
>>like Proxomitron) to make sure they do what you want them to do.[/color]
>
>When you use PHP sessions, a unique ID is transported to the browser
>by a cookie, if the browser accepts it. AFAIK on the first request
>there is always a cookie sent, and if it wasn't there and a session
>has been started with the SID parameter in the URL none gets sent.
>
>This is the cookie I'm talking about. My original problem is, that if
>I run the original function on all pages, the user gets prompted twice
>for username/password. This is IMO, because this cookie (for
>successful login) is not sent through before the header command.[/color]

it is easy enough to verify on a client whether it is actually a
problem with the session cookie.

the one thing that crossed my mind is the connection:clos e header you
send. i'm not 100% clear on what it does, but it seems to me at least
possible that PHP adds the cookie headers after your script
terminates, and that they may get ignored if coming after this header.

**Jochen Daum** · Jul 16 '05, 11:45 PM

Re: sending session cookie before redirect

Hi Gerhard!

On Mon, 08 Sep 2003 10:08:38 -0700, Gerhard Fiedler <me@privacy.net >
wrote:
[color=blue]
>On Mon, 08 Sep 2003 16:40:00 +1200, Jochen Daum wrote:
>[color=green][color=darkred]
>>>You say that you do something with cookies -- but there's no cookie
>>>code in what you posted. You can look at the cookie (at the client),
>>>and you can also look at the headers that get exchanged (use something
>>>like Proxomitron) to make sure they do what you want them to do.[/color]
>>
>>When you use PHP sessions, a unique ID is transported to the browser
>>by a cookie, if the browser accepts it. AFAIK on the first request
>>there is always a cookie sent, and if it wasn't there and a session
>>has been started with the SID parameter in the URL none gets sent.
>>
>>This is the cookie I'm talking about. My original problem is, that if
>>I run the original function on all pages, the user gets prompted twice
>>for username/password. This is IMO, because this cookie (for
>>successful login) is not sent through before the header command.[/color]
>
>it is easy enough to verify on a client whether it is actually a
>problem with the session cookie.
>
>the one thing that crossed my mind is the connection:clos e header you
>send. i'm not 100% clear on what it does, but it seems to me at least
>possible that PHP adds the cookie headers after your script
>terminates, and that they may get ignored if coming after this header.[/color]

I added that after reading a post on www.php.net/header, which seemed
to match a bit, its the same problem without.

Jochen

--
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.
http://sourceforge.net/projects/phpdbedittk/

**Gerhard Fiedler** · Jul 16 '05, 11:45 PM

Re: sending session cookie before redirect

On Tue, 09 Sep 2003 07:28:03 +1200, Jochen Daum wrote:
[color=blue][color=green]
>>the one thing that crossed my mind is the connection:clos e header you
>>send. i'm not 100% clear on what it does, but it seems to me at least
>>possible that PHP adds the cookie headers after your script
>>terminates, and that they may get ignored if coming after this header.[/color]
>
>I added that after reading a post on www.php.net/header, which seemed
>to match a bit, its the same problem without.[/color]

well, then the only thing that comes to my mind is to look at the
headers that you are sending and receiving, with a proxy tool like
proxomitron or so.

**11abacus** · Jul 16 '05, 11:45 PM

Re: sending session cookie before redirect

Jochen Daum <jochen.daum@ca ns.co.nz> wrote in message news:<pn5glvkla pkk1dbdqrqfm7h5 edbq7hq9vp@4ax. com>...[color=blue]
> Hi!
>
> I have a function in a lot of pages, which redirects to a new page, if
> a form has been submitted:
>
> i believe this is, because the cookie do not get sent before the
> header ("Location:
> Has anyone an idea how to force this or send them by hand?
>
> Cheers, Jochen[/color]

Hi,

"Set-Cookie:" and "Location:" HTTP headers don't mix well with most
web browsers. Instead of using "Location:" header, put a "Refresh:"
HTTP header, <meta http-equiv="refresh" content="0, URL=..."/> or a
JavaScript "document.repla ce.location(... )" to have the web-browser
accept the cookie. Best is probably a mix of all. I usually favor the
JavaScript approach because it keeps the "History" clean of the
intermediate redirection page.

To be sure of what's going on, enable "prompt for cookies" in your
web-browser settings (make sure you delete any previously "Remember my
decision" type of settings.)

I hope this helps.

-Philippe
[ 11abacus.com ]

sending session cookie before redirect

sending session cookie before redirect

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment