Sessions - Not working with IE

Collapse
This topic is closed.
X
X
 
  • Time
  • Show
Clear All
new posts
  • Steve Wright

    #1

    Sessions - Not working with IE

    Forgive my ignorance, but I am just starting to learn about sessions in
    PHP and how to pass data from one page to the next. What I'm about to
    explain could just be my misunderstandin g of how sessions work.

    I have two test scripts. The first starts a session, displays a few
    details and a form. When the form is submitted it jumps to the second
    page. The first script looks like this.

    <?php
    session_start() ;
    ?>
    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dt d">
    <html xmlns="http://www.w3.org/1999/xhtml">
    <head>
    <title>Sessio n test : Page 1</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"
    />
    </head>
    <body>
    <ul>
    <?php
    $_SESSION['session_var'] = "testing";
    echo "<li>Your session id is ".session_id(). "</li>\n";
    echo "<li>The SESSION array contains<br />\n";
    print_r($_SESSI ON);
    echo "</li>\n";
    echo "<li>The SID is ".SID."</li>\n";
    echo "<li>PHPSES SID = ".$PHPSESSI D."</li>\n";
    ?>
    </ul>
    This is the test of the sessions feature
    <form action="session 2.php" method="post">
    <input type="hidden" name="form_var" value="testing" />
    <input type="submit" value="Go to next page" />
    </form>
    </body>
    </html>

    The second script displays the same variables as the first. In addition
    it dislpays the value of a variable passed by the _$SESSION array and a
    value passed via a form. It looks like this.

    <?php
    session_start() ;
    ?>
    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dt d">
    <html xmlns="http://www.w3.org/1999/xhtml">
    <head>
    <title>Sessio n test : Page 2</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"
    />
    </head>
    <body>
    <ul>
    <?php
    echo "<li>Your session id is ".session_id(). "</li>\n";
    echo "<li>The SESSION array contains<br />\n";
    print_r($_SESSI ON);
    echo "</li>\n";
    echo "<li>The SID is ".SID."</li>\n";
    echo "<li>PHPSES SID = ".$PHPSESSI D."</li>\n";
    echo "<li>session_va r = {".$_SESSION['session_var']."}</li>\n";
    echo "<li>form_v ar = {".$_POST['form_var']."}</li>\n";
    ?>
    </ul>
    </body>
    </html>

    When run under IE6, I get the following output.

    Script 1

    · Your session id is d7e201df8eb6ac9 fd76915e5305166 6d
    · The SESSION array contains
    Array ( [session_var] =testing )
    · The SID is PHPSESSID=d7e20 1df8eb6ac9fd769 15e53051666d
    · PHPSESSID =

    Script 2

    · Your session id is 40211048ab6869c 74dc8e9dff6098d c0
    · The SESSION array contains
    Array ( )
    · The SID is PHPSESSID=40211 048ab6869c74dc8 e9dff6098dc0
    · PHPSESSID =
    · session_var = {}
    · form_var = {testing}

    Note how the session id is different and the variable passed by the
    _$SESSION array is blank.

    When run under Firefox 2.0 I get the following;

    · Your session id is 00802b0742fdb87 cda553cba85027c 30
    · The SESSION array contains
    Array ( [session_var] =testing )
    · The SID is PHPSESSID=00802 b0742fdb87cda55 3cba85027c30
    · PHPSESSID =

    and

    · Your session id is 00802b0742fdb87 cda553cba85027c 30
    · The SESSION array contains
    Array ( [session_var] =testing )
    · The SID is
    · PHPSESSID =
    · session_var = {testing}
    · form_var = {testing}

    This time, the session ids are the same and the variable is passed.

    Any ideas why the difference?
    With Firefox, why is SID populated on the first page and not the
    second?
    Why is PHPSESSID blank?

    In case it helps, the values from the php.ini file for session are;

    session.auto_st art = 0
    session.cache_e xpire = 180
    session.cache_l imiter = nocache
    session.cookie_ domain =
    session.cookie_ lifetime = 0
    session.cookie_ path = /
    session.entropy _file =
    session.entropy _length = 0
    session.gc_maxl ifetime = 1440
    session.gc_prob ability = 1
    session.name = PHPSESSID
    session.referer _check =
    session.save_ha ndler = files
    session.save_pa th = /tmp
    session.seriali ze_handler = php
    session.use_coo kies = 1
    session.use_tra ns_sid = 1

    Regards
    Steve Wright

  • Erwin Moller

    #2
    Re: Sessions - Not working with IE

    Steve Wright wrote:
    Forgive my ignorance, but I am just starting to learn about sessions in
    PHP and how to pass data from one page to the next. What I'm about to
    explain could just be my misunderstandin g of how sessions work.
    >
    I have two test scripts. The first starts a session, displays a few
    details and a form. When the form is submitted it jumps to the second
    page. The first script looks like this.
    >
    <?php
    session_start() ;
    ?>
    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dt d">
    <html xmlns="http://www.w3.org/1999/xhtml">
    <head>
    <title>Sessio n test : Page 1</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"
    />
    </head>
    <body>
    <ul>
    <?php
    $_SESSION['session_var'] = "testing";
    echo "<li>Your session id is ".session_id(). "</li>\n";
    echo "<li>The SESSION array contains<br />\n";
    print_r($_SESSI ON);
    echo "</li>\n";
    echo "<li>The SID is ".SID."</li>\n";
    echo "<li>PHPSES SID = ".$PHPSESSI D."</li>\n";
    ?>
    </ul>
    This is the test of the sessions feature
    <form action="session 2.php" method="post">
    <input type="hidden" name="form_var" value="testing" />
    <input type="submit" value="Go to next page" />
    </form>
    </body>
    </html>
    >
    The second script displays the same variables as the first. In addition
    it dislpays the value of a variable passed by the _$SESSION array and a
    value passed via a form. It looks like this.
    >
    <?php
    session_start() ;
    ?>
    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dt d">
    <html xmlns="http://www.w3.org/1999/xhtml">
    <head>
    <title>Sessio n test : Page 2</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"
    />
    </head>
    <body>
    <ul>
    <?php
    echo "<li>Your session id is ".session_id(). "</li>\n";
    echo "<li>The SESSION array contains<br />\n";
    print_r($_SESSI ON);
    echo "</li>\n";
    echo "<li>The SID is ".SID."</li>\n";
    echo "<li>PHPSES SID = ".$PHPSESSI D."</li>\n";
    echo "<li>session_va r = {".$_SESSION['session_var']."}</li>\n";
    echo "<li>form_v ar = {".$_POST['form_var']."}</li>\n";
    ?>
    </ul>
    </body>
    </html>
    >
    When run under IE6, I get the following output.
    >
    Script 1
    >
    · Your session id is d7e201df8eb6ac9 fd76915e5305166 6d
    · The SESSION array contains
    Array ( [session_var] =testing )
    · The SID is PHPSESSID=d7e20 1df8eb6ac9fd769 15e53051666d
    · PHPSESSID =
    >
    Script 2
    >
    · Your session id is 40211048ab6869c 74dc8e9dff6098d c0
    · The SESSION array contains
    Array ( )
    · The SID is PHPSESSID=40211 048ab6869c74dc8 e9dff6098dc0
    · PHPSESSID =
    · session_var = {}
    · form_var = {testing}
    >
    Note how the session id is different and the variable passed by the
    _$SESSION array is blank.
    >
    When run under Firefox 2.0 I get the following;
    >
    · Your session id is 00802b0742fdb87 cda553cba85027c 30
    · The SESSION array contains
    Array ( [session_var] =testing )
    · The SID is PHPSESSID=00802 b0742fdb87cda55 3cba85027c30
    · PHPSESSID =
    >
    and
    >
    · Your session id is 00802b0742fdb87 cda553cba85027c 30
    · The SESSION array contains
    Array ( [session_var] =testing )
    · The SID is
    · PHPSESSID =
    · session_var = {testing}
    · form_var = {testing}
    >
    This time, the session ids are the same and the variable is passed.
    >
    Any ideas why the difference?
    With Firefox, why is SID populated on the first page and not the
    second?
    Why is PHPSESSID blank?
    >
    In case it helps, the values from the php.ini file for session are;
    >
    session.auto_st art = 0
    session.cache_e xpire = 180
    session.cache_l imiter = nocache
    session.cookie_ domain =
    session.cookie_ lifetime = 0
    session.cookie_ path = /
    session.entropy _file =
    session.entropy _length = 0
    session.gc_maxl ifetime = 1440
    session.gc_prob ability = 1
    session.name = PHPSESSID
    session.referer _check =
    session.save_ha ndler = files
    session.save_pa th = /tmp
    session.seriali ze_handler = php
    session.use_coo kies = 1
    session.use_tra ns_sid = 1
    >
    Regards
    Steve Wright
    Hi Steve,

    This is strange indeed.
    Did you by any chance disable cookies on IE?

    Also look for a ini value named:
    session.use_onl y_cookies
    (That one is added in version 4.3)

    Or are you maybe using an older version of PHP?
    (If so, please upgrade.)

    Regards,
    Erwin Moller

    Comment

    • Steve Wright

      #3
      Re: Sessions - Not working with IE



      On Oct 26, 9:49 am, Erwin Moller
      <since_humans_r ead_this_I_am_s pammed_too_m... @spamyourself.c omwrote:
      Steve Wright wrote:
      Forgive my ignorance, but I am just starting to learn about sessions in
      PHP and how to pass data from one page to the next. What I'm about to
      explain could just be my misunderstandin g of how sessions work.
      >
      I have two test scripts. The first starts a session, displays a few
      details and a form. When the form is submitted it jumps to the second
      page. The first script looks like this.
      >
      [script snipped]
      >
      The second script displays the same variables as the first. In addition
      it dislpays the value of a variable passed by the _$SESSION array and a
      value passed via a form. It looks like this.
      >
      [Script snipped]
      >
      When run under IE6, I get the following output.
      >
      Script 1
      >
      · Your session id is d7e201df8eb6ac9 fd76915e5305166 6d
      · The SESSION array contains
      Array ( [session_var] =testing )
      · The SID is PHPSESSID=d7e20 1df8eb6ac9fd769 15e53051666d
      · PHPSESSID =
      >
      Script 2
      >
      · Your session id is 40211048ab6869c 74dc8e9dff6098d c0
      · The SESSION array contains
      Array ( )
      · The SID is PHPSESSID=40211 048ab6869c74dc8 e9dff6098dc0
      · PHPSESSID =
      · session_var = {}
      · form_var = {testing}
      >
      Note how the session id is different and the variable passed by the
      _$SESSION array is blank.
      >
      When run under Firefox 2.0 I get the following;
      >
      · Your session id is 00802b0742fdb87 cda553cba85027c 30
      · The SESSION array contains
      Array ( [session_var] =testing )
      · The SID is PHPSESSID=00802 b0742fdb87cda55 3cba85027c30
      · PHPSESSID =
      >
      and
      >
      · Your session id is 00802b0742fdb87 cda553cba85027c 30
      · The SESSION array contains
      Array ( [session_var] =testing )
      · The SID is
      · PHPSESSID =
      · session_var = {testing}
      · form_var = {testing}
      >
      This time, the session ids are the same and the variable is passed.
      >
      Any ideas why the difference?
      With Firefox, why is SID populated on the first page and not the
      second?
      Why is PHPSESSID blank?
      >
      In case it helps, the values from the php.ini file for session are;
      >
      session.auto_st art = 0
      session.cache_e xpire = 180
      session.cache_l imiter = nocache
      session.cookie_ domain =
      session.cookie_ lifetime = 0
      session.cookie_ path = /
      session.entropy _file =
      session.entropy _length = 0
      session.gc_maxl ifetime = 1440
      session.gc_prob ability = 1
      session.name = PHPSESSID
      session.referer _check =
      session.save_ha ndler = files
      session.save_pa th = /tmp
      session.seriali ze_handler = php
      session.use_coo kies = 1
      session.use_tra ns_sid = 1
      >
      Regards
      Steve WrightHi Steve,
      >
      This is strange indeed.
      Did you by any chance disable cookies on IE?
      >
      Also look for a ini value named:
      session.use_onl y_cookies
      (That one is added in version 4.3)
      >
      Or are you maybe using an older version of PHP?
      (If so, please upgrade.)
      >
      Regards,
      Erwin Moller
      As far as I can tell, I have not disabled cookies. The website runs in
      the trusted zone and the security level on that zone is set to "Low".
      Is there any other settings I should be checking in IE6?

      The session.use_onl y_cookies is not defined in the php.ini. According
      to my book (APRESS Beginning PHP and MySQL5 by Jason Gilmore), the
      default value for this is 0.
      >From the phpinfo() call, the session section says the following
      Directive Local Value Master Value
      session.auto_st art Off Off
      session.bug_com pat_42 On On
      session.bug_com pat_warn On On
      session.cache_e xpire 180 180
      session.cache_l imiter nocache nocache
      session.cookie_ domain no value no value
      session.cookie_ lifetime 0 0
      session.cookie_ path / /
      session.cookie_ secure Off Off
      session.entropy _file no value no value
      session.entropy _length 0 0
      session.gc_divi sor 100 100
      session.gc_maxl ifetime 1440 1440
      session.gc_prob ability 1 1
      session.hash_bi ts_per_characte r 4 4
      session.hash_fu nction 0 0
      session.name PHPSESSID PHPSESSID
      session.referer _check no value no value
      session.save_ha ndler files files
      session.save_pa th no value no value
      session.seriali ze_handler php php
      session.use_coo kies On On
      session.use_onl y_cookies Off Off
      session.use_tra ns_sid 0

      We are running PHP v5.0.4

      I wouldn't mind if it worked under IE and not FF, but this is an
      intranet application and IE6 is the company standard :-(

      Comment

      • Steve Wright

        #4
        Re: Sessions - Not working with IE

        Cracked it!

        Because I have access to work from home over a VPN, the company have
        installed a firewall (Zone Alarm integrity client). This was blocking
        the cookies.

        As I am at work and behind the corporate firewall, I have shutdown my
        local firewall. IE6 now works.

        Interesting how IE6 was affected when the local firewall in in
        operation, but Firefox wasn't.

        Thanks for the help

        Comment

        • readme@now.com

          #5
          Re: Sessions - Not working with IE

          In article <1161859776.361 895.301470@m7g2 000cwm.googlegr oups.com>,
          stevewrightuk@g ooglemail.com says...
          Cracked it!
          >
          Because I have access to work from home over a VPN, the company have
          installed a firewall (Zone Alarm integrity client). This was blocking
          the cookies.
          >
          As I am at work and behind the corporate firewall, I have shutdown my
          local firewall. IE6 now works.
          >
          Interesting how IE6 was affected when the local firewall in in
          operation, but Firefox wasn't.
          >
          Thanks for the help
          >
          >
          You should notify your tech support department - clearly they are not
          aware their firewall doesnt work if Firefox is in use - if that is the
          case your company doesn't actually have a firewall it has a bit of wet
          tissue paper instead.

          Comment

          • Erwin Moller

            #6
            Re: Sessions - Not working with IE

            Steve Wright wrote:
            Cracked it!
            >
            Because I have access to work from home over a VPN, the company have
            installed a firewall (Zone Alarm integrity client). This was blocking
            the cookies.
            >
            As I am at work and behind the corporate firewall, I have shutdown my
            local firewall. IE6 now works.
            >
            Interesting how IE6 was affected when the local firewall in in
            operation, but Firefox wasn't.
            >
            Thanks for the help
            Hi Steve,

            Glad you solved it, but check as 'readme' said why FF is working without
            cookiefiltering .

            I do not understand: why would a firewall filter cookies out?
            Cookies are a normal part of a http-request.
            What kind of 'security improvement' does that offer?
            I don't get it.

            Does the firewall also check the HTML for undesired text?
            Does it add missing </td>'s?

            Seriously, can anybody explain to me why a firewall filters cookies?

            Regards,
            Erwin Moller

            Comment

            • holly

              #7
              Re: Sessions - Not working with IE

              In article <4540bc78$0$323 $e4fe514c@news. xs4all.nl>,
              since_humans_re ad_this_I_am_sp am...yourself.co m says...
              Steve Wright wrote:
              >
              Cracked it!

              Because I have access to work from home over a VPN, the company have
              installed a firewall (Zone Alarm integrity client). This was blocking
              the cookies.

              As I am at work and behind the corporate firewall, I have shutdown my
              local firewall. IE6 now works.

              Interesting how IE6 was affected when the local firewall in in
              operation, but Firefox wasn't.

              Thanks for the help
              >
              Hi Steve,
              >
              Glad you solved it, but check as 'readme' said why FF is working without
              cookiefiltering .
              >
              I do not understand: why would a firewall filter cookies out?
              Cookies are a normal part of a http-request.
              What kind of 'security improvement' does that offer?
              I don't get it.
              >
              Does the firewall also check the HTML for undesired text?
              Does it add missing </td>'s?
              >
              Seriously, can anybody explain to me why a firewall filters cookies?
              >
              Regards,
              Erwin Moller
              >
              >
              Because cookies are dangerous.
              Cookies have always been dangerous
              cookies will always be dangerous
              If anyone tells you different - they are wrong.

              Comment

              • Petr Vileta

                #8
                Re: Sessions - Not working with IE

                "holly" <holly.n@xmasho use.co.ukpíše v diskusním pøíspìvku
                news:MPG.1fac32 2d1deb726498992 5@news-text.blueyonder .co.uk...
                In article <4540bc78$0$323 $e4fe514c@news. xs4all.nl>,
                since_humans_re ad_this_I_am_sp am...yourself.co m says...
                >Steve Wright wrote:
                >>
                Because cookies are dangerous.
                Cookies have always been dangerous
                cookies will always be dangerous
                If anyone tells you different - they are wrong.
                Cookies are good and I'm right. Jam cookies, cottage cookies or poppy
                cookies and tea ...

                --

                Petr Vileta, Czech republic
                (My server rejects all messages from Yahoo and Hotmail. Send me your mail
                from another non-spammer site please.)


                Comment

                Working...