Bug #17704 Updated: When the cookie on the client expires, the sessiongets messy

ID: 17704 Updated by: thiago@softexpert.com Reported By: thiago@softexpert.com Status: Open Bug Type: Session related Operating System: Windows 2000 PHP Version: 4.2.1 New Comment: i wrote cooking, but i mean cookie. and im using NTFS filesystem. Previous Comments: ------------------------------------------------------------------------ [2002-06-11 22:08:30] thiago@softexpert.com reopening it.. hope its better now :) ------------------------------------------------------------------------ [2002-06-11 22:04:25] thiago@softexpert.com Ok.. let me explain it better.. I have a php script that creates a session with session_name() and session_start(). This session is created with the default cookie expire option which is "expires when the browser is closed". At the end of this script (actually, its more than 1 file) the session is destroyed with session_destroy(). When i execute (run) this script again (same code) it creates 2 session ID on my session_save_path (where session data is saved). One ID is the old expired ID and the other is the new ID. The session data is stored on the old ID (the expired one) and $_SESSION["var"] is read from the new ID. It doesnt return the expected value because the value is on the old expired ID that shouldnt be created again. This happens when i close the browser (making the session cookie expire) before executing (running) the script for the second time. If i execute (run) it without closing the browser, it justs creates the same ID and works fine which is the expected behaviour because the cooking isnt expired. So, the thing is, php is creating sessions based on expired session cookies and its getting lost too because its making the expired (old) sessions live again and its creating the new session too. And everything gets messy. Im using Windows 2000 with php 4.2.1. I tested it with I.E 6.0 and with Mozilla 1.0. The web-server is IIS 5 with CGI. register_globals is off. Is it clear enought ? thank you very much. ------------------------------------------------------------------------ [2002-06-11 18:19:35] sniper@php.net Not enough information was provided for us to be able to handle this bug. Please re-read the instructions at http://bugs.php.net/how-to-report.php If you can provide more information, feel free to add it to this bug and change the status back to "Open". Thank you for your interest in PHP. ------------------------------------------------------------------------ [2002-06-11 12:20:53] thiago@softexpert.com Let me explain it better: I think the session_start() is not checking if the session is expired or not (or this checking is broken), so its creating more than one session_id. One with the expired ID and another with the new ID. A third ID is appearing too, but i dont know why. Im using session_name() before calling session_start() on all parts of the code. ------------------------------------------------------------------------ [2002-06-11 12:11:47] thiago@softexpert.com Try this steps: 1 - Clear the session_save_path dir. 2 - Create a session with expires=0 3 - Destroy this session 4 - Close the browser (I.E) 5 - Open the browser and access the same page where the session was created 6 - Look at the session_save_path dir. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=17704&edit=1