Re: Followup to session question / scope of session

On Friday, July 19, 2002, at 01:39 PM, Chad Day wrote:

Anyone? I'm looking on google for help and found 2 people asking similar questions, but both got no replies. Is it not possible to pass session data across subdomains? If so, what workaround can I use to keep the user authenticated? Do I just pass the session ID in the URL? That kind of sucks. :(

[...]

I could set a cookie with a value, but I don't want to risk spoofing of cookies, etc.. I'd much rather keep a registered session variable which I can check to see if it exists, and use that to authenticate.

No, the whole problem is that you're depending on cookies to persist the session ID for you. Which is normally fine, except that cookies have their own rules about which domains they will send data to. Specifically, a cookie set in virtualhost1.mydomain.com will not be available to virtualhost2.mydomain.com unless you have ensured that the "domain" attribute of the cookie is set to the common .mydomain.com so that any virtualhost/subdomain has access to the cookie. This level of cookie handling is normally abstracted away from the programmer, but it is changeable. You can change cookie values with JavaScript, and with PHP's setcookie() function. Read the man page for more info. (I do not know if the domain set by session_start() is the broader ".mydomain.com" or the narrower "virtualhostx.mydomain.com", but you could investigate this.) Erik