RE: [PHP] Followup to session question / scope of session
| From: | Chad Day | Date: | Fri, 19 Jul 2002 18:40:40 +0000 |
| Subject: | RE: [PHP] Followup to session question / scope of session | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-108559@lists.php.net to get a copy of this message | ||
Ok.. let me try to explain a bit further.
My domain is online-leagues.com
www.online-leagues.com is aliased to it.
If I refer to a script without the filename
(http://www.online-leagues.com/my), Apache apparently interprets that as
(http://online-leagues.com/my/look-for-the-index-file). If I use
http://www.online-leagues.com/my/index.php,
my session obviously will work
as intended.
Now, I could just rewrite all the URLs, but in the near future I want to be
able to have http://my.online-leagues.com and
http://calendar.online-leagues.com working and use
data in those sessions.
I'm not sure what cookies have to do with this, aside from passing along the
session id. I wrote up some test login scripts:
http://www.online-leagues.com/leagues/testdir/loginme.php
:
<?
session_start();
$I_AM_A_NEW_VALID_USER = '1';
session_register("I_AM_A_NEW_VALID_USER");
echo "<a href=\"http://online-leagues.com/leagues/testdir/index.php?";
echo $PHPSESSID;
echo "\">link</a>";
?>
Have to do one reload first to get the $PHPSESSID variable to append (I
don't know why), but on the next page, the check fails:
<?
session_start();
function check_me() {
global $I_AM_A_NEW_VALID_USER;
if (session_is_registered("I_AM_A_NEW_VALID_USER")) {
echo "valid";
} else {
echo "invalid";
exit();
}
}
echo $SID;
echo '<br>';
echo $I_AM_A_NEW_VALID_USER;
check_me();
?>
I apologize if I am missing something basic here / am not understanding.. I
just don't know what I have to do to get my session to work across that
entire domain.. I thought worst case, passing along the SID would work, but
that doesn't seem to be working either.
Thanks,
Chad
-----Original Message-----
From: Erik Price [mailto:erikprice@mac.com]
Sent: Friday, July 19, 2002 2:25 PM
To: Chad Day
Cc: php-general@lists.php.net
Subject: Re: [PHP] Followup to session question / scope of session
On Friday, July 19, 2002, at 01:39 PM, Chad Day wrote:
> Anyone? I'm looking on google for help and found 2 people asking
> similar
> questions, but both got no replies. Is it not possible to pass session
> data
> across subdomains? If so, what workaround can I use to keep the user
> authenticated? Do I just pass the session ID in the URL? That kind of
> sucks. :(
[...]
> I could set a cookie with a value, but I don't want to risk spoofing of
> cookies, etc.. I'd much rather keep a registered session variable
> which I
> can check to see if it exists, and use that to authenticate.
No, the whole problem is that you're depending on cookies to persist the
session ID for you. Which is normally fine, except that cookies have
their own rules about which domains they will send data to.
Specifically, a cookie set in
virtualhost1.mydomain.com
will not be available to
virtualhost2.mydomain.com
unless you have ensured that the "domain" attribute of the cookie is set
to the common
.mydomain.com
so that any virtualhost/subdomain has access to the cookie. This level
of cookie handling is normally abstracted away from the programmer, but
it is changeable. You can change cookie values with JavaScript, and
with PHP's setcookie() function. Read the man page for more info.
(I do not know if the domain set by session_start() is the broader
".mydomain.com" or the narrower "virtualhostx.mydomain.com", but you
could investigate this.)
Erik
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php