Why is session lost on redirect?

**Tony Marston** · Jul 17 '05, 11:59 AM

Re: Why is session lost on redirect?

You must use session_start() at the beginning of EVERY script that
reads/writes session data, not just those that write to it.

--
Tony Marston

Tony Marston's Web Site

http://www.tonymarston.net

This is Tony Marston's web site, containing personal information plus pages devoted to the Uniface 4GL development language, XML and XSL, PHP and MySQL, and a bit of COBOL

"deko" <deko@hotmail.c om> wrote in message
news:RxaYd.1709 8$Pz7.4974@news svr13.news.prod igy.com...[color=blue]
> I'm trying to create a very basic login page that will redirect a logged
> in
> user to a secure page. I set the session_start variable at the top of the
> login page, then redirect to securePage.php if the user enters the right
> credentials.
>
> The redirect works, but apparently $HTTP_SESSION_V ARS['loggedin'] is not
> getting set because I cannot view securePage.php.
>
> Am I setting $HTTP_SESSION_V ARS correctly? My guess is I'm missing
> something elementary. How can I get the session to carry over to the
> redirected page?
>
> Thanks in advance.
>
> <?php session_start ?>
> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
> <html>
> <head>
> <META NAME="ROBOTS" CONTENT="NOINDE X, NOFOLLOW">
> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
> [java script, html...]
> <h4>Login Form</h4>
> <form action="" method="post" name="login">
> User Name:
> <input name="username" type="text" size="30" maxlength="100"/><br />
> Password:
> <input name="password" type="password" size="30" maxlength="10"> <br />
> <input name="Login" type="submit" value="Login">
> </form>
> <?php
> if ($username == "Bob" && $password ="Smith")
> {
> $HTTP_SESSION_V ARS['loggedin'] = 1;
> $url="http://www.mysite.com/securePage.php" ;
> ?>
> <script language="javas cript">
> window.location .href=("<?php echo $url; ?>");
> </script>
> <?
> }
> ?>
> [more html]
> </body>
> </html>
>
>
> ==============
> [securePage.php]
> <?php
> session_start() ;
> if (isset($HTTP_SE SSION_VARS['loggedin']))
> {
> echo "You are logged in.";
> }
> else
> {
> echo "You are not logged in.";
> }
> ?>
>
>[/color]

**deko** · Jul 17 '05, 11:59 AM

Re: Why is session lost on redirect?

> You must use session_start() at the beginning of EVERY script that[color=blue]
> reads/writes session data, not just those that write to it.[/color]

Thanks for the tip, but...
I tried adding session_start() (at line ****), but I get the same results.
I also tried using $_SESSION instead of $HTTP_SESSION_V ARS, as shown below.
Still, when I arrive at securePage, $_SESSION is empty.

<?php session_start ?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
<html>
<head>
<META NAME="ROBOTS" CONTENT="NOINDE X, NOFOLLOW">
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
[java script, html...]
<h4>Login Form</h4>
<form action="" method="post" name="login">
User Name:
<input name="username" type="text" size="30" maxlength="100"/><br />
Password:
<input name="password" type="password" size="30" maxlength="10"> <br />
<input name="Login" type="submit" value="Login">
</form>
<?php
session_start() ****
if ($username == "Bob" && $password ="Smith")
{
$_SESSION['s'] = 1;
$url="http://www.mysite.com/securePage.php" ;
?>
<script language="javas cript">
window.location .href=("<?php echo $url; ?>");
</script>
<?
}
?>
[more html]
</body>
</html>

==============
[securePage.php]
<?php
session_start() ;
if (isset($_SESSIO N['s']))
{
echo "You are logged in.";
}
else
{
echo "You are not logged in.";
}
?>

**Brent Palmer** · Jul 17 '05, 12:00 PM

Re: Why is session lost on redirect?

Hello.
This works fine for me.
The main difference is that I registered the var first.
Brent Palmer.

<?php
session_start() ;
session_registe r("loggedin") ;
$loggedin = false;
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
<html>
<head>
<META NAME="ROBOTS" CONTENT="NOINDE X, NOFOLLOW">
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
[java script, html...]
<h4>Login Form</h4>
<form action="" method="post" name="login">
User Name:
<input name="username" type="text" size="30" maxlength="100"/><br />
Password:
<input name="password" type="password" size="30" maxlength="10"> <br />
<input name="Login" type="submit" value="Login">
</form>
<?php

if ($username == "Bob" && $password ="Smith")
{
$loggedin = true;
$url="http://www.mysite.com/securePage.php" ;
?>
<script language="javas cript">
window.location .href=("<?php echo $url; ?>");
</script>
<?
}
?>
[more html]
</body>
</html>

"deko" <deko@hotmail.c om> wrote in message
news:cXbYd.8010 $C47.3372@newss vr14.news.prodi gy.com...[color=blue][color=green]
>> You must use session_start() at the beginning of EVERY script that
>> reads/writes session data, not just those that write to it.[/color]
>
> Thanks for the tip, but...
> I tried adding session_start() (at line ****), but I get the same results.
> I also tried using $_SESSION instead of $HTTP_SESSION_V ARS, as shown
> below.
> Still, when I arrive at securePage, $_SESSION is empty.
>
> <?php session_start ?>
> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
> <html>
> <head>
> <META NAME="ROBOTS" CONTENT="NOINDE X, NOFOLLOW">
> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
> [java script, html...]
> <h4>Login Form</h4>
> <form action="" method="post" name="login">
> User Name:
> <input name="username" type="text" size="30" maxlength="100"/><br />
> Password:
> <input name="password" type="password" size="30" maxlength="10"> <br />
> <input name="Login" type="submit" value="Login">
> </form>
> <?php
> session_start() ****
> if ($username == "Bob" && $password ="Smith")
> {
> $_SESSION['s'] = 1;
> $url="http://www.mysite.com/securePage.php" ;
> ?>
> <script language="javas cript">
> window.location .href=("<?php echo $url; ?>");
> </script>
> <?
> }
> ?>
> [more html]
> </body>
> </html>
>
>
> ==============
> [securePage.php]
> <?php
> session_start() ;
> if (isset($_SESSIO N['s']))
> {
> echo "You are logged in.";
> }
> else
> {
> echo "You are not logged in.";
> }
> ?>
>
>[/color]

**R. Rajesh Jeba Anbiah** · Jul 17 '05, 12:00 PM

Re: Why is session lost on redirect?

Brent Palmer wrote:[color=blue]
> Hello.
> This works fine for me.
> The main difference is that I registered the var first.[/color]

PHP: Manual Quick Reference

http://in.php.net/session_register

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

--
<?php echo 'Just another PHP saint'; ?>
Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/

**R. Rajesh Jeba Anbiah** · Jul 17 '05, 12:00 PM

Re: Why is session lost on redirect?

deko wrote:[color=blue][color=green]
> > You must use session_start() at the beginning of EVERY script that
> > reads/writes session data, not just those that write to it.[/color]
>
> Thanks for the tip, but...
> I tried adding session_start() (at line ****), but I get the same[/color]
results.[color=blue]
> I also tried using $_SESSION instead of $HTTP_SESSION_V ARS, as shown[/color]
below.[color=blue]
> Still, when I arrive at securePage, $_SESSION is empty.[/color]

It seems that the session cookie is not set--IOW, session id is not
passed to that page. If you're using trans sid, it won't append SID in
headers (header('Locati on:..'))--which you may have to do manually.

Also, add the following two lines in the beginning of your script:
<?php
ini_set('displa y_errors', 1);
error_reporting (E_ALL|E_STRICT );
?>

--
<?php echo 'Just another PHP saint'; ?>
Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/

**deko** · Jul 17 '05, 12:00 PM

Re: Why is session lost on redirect?

> Also, add the following two lines in the beginning of your script:[color=blue]
> <?php
> ini_set('displa y_errors', 1);
> error_reporting (E_ALL|E_STRICT );
> ?>[/color]

Thanks, that helps. As for losing the session on redirect, the problem was
that the login page was SSL-encrypted and the redirect page was not. Now
that both pages are SSL-encrypted, it works fine.

I have another question about timing out the session - will repost.

Why is session lost on redirect?

Why is session lost on redirect?

Comment

Comment

Comment

Comment

Comment

Comment