PHP Session Issue

[Virendra Maloo]

I have developed an (PHP)applicatio n which has been tested on different development servers.

So when I login to the app and navigate to a specific page just after loggin-in, the app logs-out and I have to re-enter the user credentials. But after loggin-in again, it works fine(and doesn't shows the log-in screen until we log-out). I wonder why it works in such an unpredictable way.!!

I have used session for security reasons and am quite eager to know if this is something to do with cache.

I am using the below code on almost all the pages of the app.(so that the user just can't enter the URL of the page and start accessing the application)

session_start();
	
	header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
	header("Cache-Control: no-store, no-cache, must-revalidate");
	header("Cache-Control: post-check=0, pre-check=0", false);
	header("Pragma: no-cache");

/*
The app matches the current session-ID with the session ID which previous page has sent and if it doesn't matches, LOG-Out.
*/

try {
	 if(($_GET['session'])==(session_id())){	
//                   do nothing
 }else{
		echo '<script type="text/javascript">parent.location="../index.php";</script>';
}
 }catch(Exception $e){
		echo '<script type="text/javascript">parent.location="../index.php";</script>';
}

I strongly feel that if the app performs well on one server then it shud work perfectly fine on the other system.

I, however have no idea of the php.ini file on the server which throws this issue of loggin-out. but I can certainly find out the details if it is something to do with php.ini file.

If there's any modification I need to do in the cache setting, lemme know.


Any help/suggestion would be appreciated.
Virendra Maloo.

[Dormilich]

it’s a little difficult without knowing the session parameters…

if(($_GET['session'])==(session_id())){

that’s a rather strange test. to work, it requires the session variable to be manipulated. check the following:
- session_name() (checks, if the session parameter is named "session")
- ini_get("sessio n.use_trans_sid ") (checks if the session id is written in the url)
- ini_get("sessio n.use_cookies") (dito, only for cookies)
- ini_get("sessio n.use_only_cook ies") (checks, if the session is not written in the URL))

and I doubt that session_id() can throw an Exception, thus I’d omit the try…catch for this session check.

[Virendra Maloo]

Thanks for that quick reply.

session_name() (checks, if the session parameter is named "session")

=> When I redirect my app to a certain page using link, what I do is :
Page1.php?sessi on=<?php echo session_id(); ?>

and the code which I had sent in the original thread is pasted on page1.php, which checks if the current session is equal to the session rec.

Do you still think that this is caused by session para?(If this was the case then y does it work perfectly from second log-in)....Isn't this cache related error?

[Dormilich]

can’t really tell, but you have a rather clumsy session system. usually you leave the session handling completely to PHP, i.e. you set some session options (like those mentioned above) and PHP and the browser handle the session for you. all that’s left is using the $_SESSION array.

to check, if you’re logged in, normally you ceck for a ‘log-in’ parameter in the session array, something along:

// the isset() prevents a notice, if the key does not exist
if (isset($_SESSION["login"]) and true == $_SESSION["login"])
    // do something for logged-in users
else
    // goto login page

or

if (!isset($_SESSION["login"]) or false == $_SESSION["login"])
    // goto login page

[Virendra Maloo]

I had performed these tricks long ago and they worked perfectly.

But the problem still occurs!!

Is this anything to do with session cookie? If yes, how do I retain the value of session (for the first time) which the first page passes onto the other pages?

If there's anything I can do with session re-storation on cookies when the user logs-on for first time, this problem can be solved..but the problem is, I have no clue on how to set the session cookie for the vey first time.

[Dormilich]

you don’t have to set the session cookie yourself. all you need is to make sure, the session.use_coo kies parameter is set to true (or 1), which is the default setting (you can check it through phpinfo()). everything else is done by PHP.

[Virendra Maloo]

"When I log-in for the first time and redirect the user to a certain page, the page expires and subsequent login-redirection works fine."
This is because the session-id I pass through the link is different than the session-id on the redirected page(only for the first time access!!!).
(I checked it by echo-ing it on screen)

[Virendra Maloo]

Was browsing randomly in php forums and landed here!
Although very late in coming back, but this issue got resolved and the app has been working fine for the last 6 years now :)