session cookies

**Dikkie Dik** · Nov 22 '05, 12:05 AM

Re: session cookies

You didn't set use_only_cookie s ? In that case, PHP should use a GET
parameter in the URL for communicating the session ID.

Marcus wrote:[color=blue]
> I know that when you start a session in PHP, the "cookie" it creates is
> not the same as those that are stored in your browser's temp folder, and
> instead is kept in RAM. I am confused because in every session tutorial
> I have ever read, the author invariably mentions the 2 main ways of
> propagating sessions - through cookies and appended to the URL. The
> author also almost always talks about the method being dependent on the
> user's preferences, for example whether he/she accepts cookies. I am so
> confused because I have tried setting my browser to reject all cookies,
> and in php.ini I have session.use_coo kies = 1. I have also restarted
> apache with both session.use_onl y_cookies = 1 and with it commented out
> as it is by default. In all cases, my scripts always work exactly like
> they should. As far as I can tell, if I am explicitly saying that PHP
> MUST use cookies to handle my sessions, and I am setting my browser to
> reject ALL cookies, my script should not execute successfully. Also,
> when I output the contents of $_COOKIE, I get my valid session id,
> meaning the cookie is being set. Meanwhile, trying to log in to other
> sites on the web that require cookies fails (as it should). If setting
> my browser to reject all cookies has no effect, what else could a user
> possibly do to make sessions using cookies not work? Thanks a bunch.[/color]

**Marcus** · Nov 22 '05, 12:05 AM

Re: session cookies

Dikkie Dik wrote:[color=blue]
> You didn't set use_only_cookie s ? In that case, PHP should use a GET
> parameter in the URL for communicating the session ID.
>[/color]

I tried it first with the default use_only_cookie s being off, and then
with it on (checked phpinfo() to make sure), and it had no effect. The
session ID is not being propagated anywhere that I can see, and like I
said, echoing the contents of $_COOKIE shows the session id.

**Peter Fox** · Nov 22 '05, 12:05 AM

Re: session cookies

Following on from Marcus's message. . .[color=blue]
>Dikkie Dik wrote:[color=green]
>> You didn't set use_only_cookie s ? In that case, PHP should use a GET
>> parameter in the URL for communicating the session ID.
>>[/color]
>
>I tried it first with the default use_only_cookie s being off, and then
>with it on (checked phpinfo() to make sure), and it had no effect. The
>session ID is not being propagated anywhere that I can see, and like I
>said, echoing the contents of $_COOKIE shows the session id.[/color]
Thought: Have you been (fully) closing your browser between all tests?

--
PETER FOX Not the same since the cardboard box company folded
peterfox@eminen t.demon.co.uk.n ot.this.bit.no. html
2 Tees Close, Witham, Essex.
Gravity beer in Essex <http://www.eminent.dem on.co.uk>

**Gordon Burditt** · Nov 22 '05, 12:05 AM

Re: session cookies

>I know that when you start a session in PHP, the "cookie" it creates is[color=blue]
>not the same as those that are stored in your browser's temp folder, and
>instead is kept in RAM.[/color]

This is the distinction between a cookie that vanishes when the browser
closes and one that stays around in the browser for a specified time.
[color=blue]
>I am confused because in every session tutorial
>I have ever read, the author invariably mentions the 2 main ways of
>propagating sessions - through cookies and appended to the URL. The
>author also almost always talks about the method being dependent on the
>user's preferences, for example whether he/she accepts cookies. I am so[/color]
[color=blue]
>confused because I have tried setting my browser to reject all cookies,[/color]

Did you also *clean out* existing cookies?

Gordon L. Burditt

**Marcus** · Nov 22 '05, 12:05 AM

Re: session cookies

Gordon Burditt wrote:[color=blue][color=green]
>>I know that when you start a session in PHP, the "cookie" it creates is
>>not the same as those that are stored in your browser's temp folder, and
>>instead is kept in RAM.[/color]
>
>
> This is the distinction between a cookie that vanishes when the browser
> closes and one that stays around in the browser for a specified time.
>
>[color=green]
>>I am confused because in every session tutorial
>>I have ever read, the author invariably mentions the 2 main ways of
>>propagating sessions - through cookies and appended to the URL. The
>>author also almost always talks about the method being dependent on the
>>user's preferences, for example whether he/she accepts cookies. I am so[/color]
>
>[color=green]
>>confused because I have tried setting my browser to reject all cookies,[/color]
>
>
> Did you also *clean out* existing cookies?
>
> Gordon L. Burditt[/color]

Gordon,

Thanks for the reply. Yes, I've cleaned out all existing cookies and
deleted all files and history just to start clean (even though I doubt
the latter 2 have any bearing). I've also restarted apache numerous
times and tried both IE and Firefox, all to no avail.

This is from my php.ini file as viewed through phpinfo():
session.use_coo kies On On
session.use_onl y_cookies On On
session.use_tra ns_sid Off Off

Now that I think about it, what good would clearing all existing cookies
in the browser do? That clears the temp directory, where php's cookies
aren't anyways... I have the default lifetime set as 0, which means they
should die once the browser is closed right?

Given all the info I have provided, am I correct in assuming my sessions
should *not* be working? Obviously I am missing something because they
are in fact working exactly as they always have.

I should mention I am doing all this testing on my localhost. Does this
have any bearing on it? I wouldn't think so but I thought it was worth
mentioning anyways.

As always, thanks for everyone's insightful help.

**Marcus** · Nov 22 '05, 12:05 AM

Re: session cookies

Wow, I can't explain this, but after just messing around with reloading
programs and everything a million times, FireFox now is behaving
correctly... the sessions don't work when cookies are disabled.

However, IE is still not right. In IE is there anything I have to do
besides tools->internet options->privacy->block all cookies?

**Gordon Burditt** · Nov 22 '05, 12:05 AM

Re: session cookies

>>>I know that when you start a session in PHP, the "cookie" it creates is[color=blue][color=green][color=darkred]
>>>not the same as those that are stored in your browser's temp folder, and
>>>instead is kept in RAM.[/color]
>>
>>
>> This is the distinction between a cookie that vanishes when the browser
>> closes and one that stays around in the browser for a specified time.
>>
>>[color=darkred]
>>>I am confused because in every session tutorial
>>>I have ever read, the author invariably mentions the 2 main ways of
>>>propagatin g sessions - through cookies and appended to the URL. The
>>>author also almost always talks about the method being dependent on the
>>>user's preferences, for example whether he/she accepts cookies. I am so[/color]
>>
>>[color=darkred]
>>>confused because I have tried setting my browser to reject all cookies,[/color]
>>
>>
>> Did you also *clean out* existing cookies?
>>
>> Gordon L. Burditt[/color]
>
>Gordon,
>
>Thanks for the reply. Yes, I've cleaned out all existing cookies and
>deleted all files and history just to start clean (even though I doubt
>the latter 2 have any bearing). I've also restarted apache numerous
>times and tried both IE and Firefox, all to no avail.
>
>This is from my php.ini file as viewed through phpinfo():
>session.use_co okies On On
>session.use_on ly_cookies On On
>session.use_tr ans_sid Off Off
>
>Now that I think about it, what good would clearing all existing cookies
>in the browser do?[/color]

If you tell the browser to reject all cookies, that may well tell it to
reject all *NEW* cookies, and to keep (and send) the ones it's already
got. If the session cookie is already in there, it stays in there.
So when you set the browser to reject all cookies *without* restarting
it, it keeps the session cookie.
[color=blue]
>That clears the temp directory,[/color]

What temp directory? I'm not aware of a *browser* that keeps cookies
in a temp directory, especially not those that expire when the
browser closes (which are normally just kept in RAM while the browser
is running).

The directory PHP uses to store session files is on the *server*,
not the *client* (a relevant distinction even if they happen to
be on the same machine).

[color=blue]
>where php's cookies
>aren't anyways... I have the default lifetime set as 0, which means they
>should die once the browser is closed right?[/color]

Are you sure you closed *ALL* the browser windows? On IE with Windows,
this might even require a reboot; I'm not sure.
[color=blue]
>Given all the info I have provided, am I correct in assuming my sessions
>should *not* be working? Obviously I am missing something because they
>are in fact working exactly as they always have.[/color]

I don't think you've given sufficient information to conclude that.
[color=blue]
>I should mention I am doing all this testing on my localhost. Does this
>have any bearing on it? I wouldn't think so but I thought it was worth
>mentioning anyways.
>
>As always, thanks for everyone's insightful help.[/color]

Gordon L. Burditt

session cookies

session cookies

Comment

Comment

Comment

Comment

Comment

Comment

Comment