PHP session variables randomly work/don't work

[annonymous]

Hello,

I have a website for which users need to login/register. They fill in a login form on index.php page. If login information is correct, I set a session variable. The script that checks the login information:

session_start() ;
[...check user and pass and if ok do:]
$_SESSION['logged_in'] = 'yes';
$_SESSION['utilizator'] = $utilizator;
$_SESSION['cont']="elev";
header("Locatio n: elev.php?pg=aca sa&user=".$util izator);
die();
[...]

The above code always gets to setting the session variables if the account information was correct, I tested this.

On the pages available only to logged in users, I check if that session variable is set:
<?php
session_start() ;
if ( $_SESSION['logged_in'] != 'yes') {
header("Locatio n: index.php?err=n eautentificat") ;
}
?>

The login sometimes works, sometimes doesn't. If I insist on logging in time after time, at some point the variable stays set and the login works. Sometimes it works from the first attempt. When I enter the account, when browsing from one page to another, sometimes I get redirected to index.php as if the session variable was not set anymore. But if I hit the "Back" button, I appear to still be logged in.

This happens both in IE and Mozilla Firefox.

Any ideas for this strange behavior ?

[TheServant]

Hmmm, very strange. I did have a similar problem quite a while ago and after re-coding everything it started working, but still not 100% sure what changed. Have you changed/looked at your $_SESSION lifetime? Is there any browser where this doesn't happen?

Your best bet is to debug by putting echo's under all the relative conditional statements. Check all your variables are being set as $_SESSION variables after login and if any are still set once it thinks you are logged out.

Can I just confirm an observation: You said sometimes you are logged in, you go to another page then you're logged out. Then you press back which says you are logged in (mybe because the page is chached) and then you go to another page and you are still logged in? If so I am very confused and it's your browser(s) acting up.

[annonymous]

I haven't looked at the lifetime. But since I check the login information, set the session variable, redirect to account page and it doesn't work...it can't be about the lifetime.

About the pages being in cache when I hit 'Back'...I can't be sure..the website has only a few pages...now when i tried the login again, I got to browsing through all the pages without being redirected to the login page...so it's a little hard to test if the behavior is random. I only tried it in mozilla firefox 3 and 2 and IE 6 on 2 computers...can 't be the browser...

I already tried the echoing. The variables are all set when the login is approved. When it thinks I'm not logged in anymore, the variables are no longer set.

Some possible scenario for this, please...

[TheServant]

Well, that's a toughie then. Really without going through your whole code there's not much we can do besides suggesting things to check. Your $_SESSION is obviously being cleared, which means that something is clearing it for some reason. Do you have session_start() above every page before any output? Is your login script only on the login page? If it's on every page, it's possible that it's still checking for the $_POST values and not finding them so resetting everything. Do you have session_destory or the like anywhere? Is that being triggered for some reason? Maybe in a logout script?

[annonymous]

It's a lot of code...a lot of files. I was hoping for this...suggesti ng things that might cause the problem.

I have session_start at the beginning of every page.

The login script is only called to handle the login form, when the user hits submit.

I have session_unset and session_destroy only in the logout script, which is called only when the user presses the logout button.

What other causes could be for the session variables to be unset ?

[Markus]

This is a common problem, and I'm sure I've had it a couple of times. Anyway, this php.net page has some discussion on the problem, and may give you a solution (read the comments).

[annonymous]

There is nothing wrong with the session variables when I test it in my apache web server on my computer. Only when hosted on the internet the session has the above mentioned problems. Any idea now? :) Change hosting? :)

[Markus]

There is nothing wrong with the session variables when I test it in my apache web server on my computer. Only when hosted on the internet the session has the above mentioned problems. Any idea now? :) Change hosting? :)

Get in touch with your hosting provider, see if they can fix the problem.