note 65854 added to ref.session

I just finished a marathon debugging session with sessions, and I wanted to share what I learned with the rest of the PHP community because this has been a problem I've battled on several projects before finally solving it today. I am using sessions to register a user's ID, and every so often, for no apparent reason, the session would seem to expire and my logged-in user would get kicked out. This is the code I am using to validate a user: <?php session_start(); $auth = false; if (isset($_SESSION['user_id'])) { $user = new User($_SESSION['user_id']); $auth = true; else { $login = $_REQUEST['login']; $password = $_REQUEST['password']; $login = clean($login); $password = clean($password); // clean() is my own function to escape quotes and so on $user = checkLogin($login,$password); if (!is_null($user)) { $auth = true; } } if (!$auth) { die("you must log in."); } // etc etc ... // ?> I was scratching my head as to why, on about 10% of the times I sent a user to a new page (a PHP page that didn't have any of the sessions stuff--no session_start() and no mention of any session variables), when they came back the session variables were all empty. I came upon a clue when I used ini_set to change the session.save_path location. My idea was that maybe the session files in /tmp were being deleted by other users on the system or something. So I added this line before session_start(): <?php ini_set('session.save_path',"/path/to/unique/dir/"); ?> I knew no one else was saving their sessions there, so I started logging in to my page and at the same time checking for the creation of new sess_* files. I noticed that sometimes, especially when I had problems, a second session file (that was empty) would appear. What I realized was that the URL was changing from www.coryforsyth.com to coryforsyth.com. When the presence of the WWW changed, PHP thought it was a different session and created an empty one that caused my script to log me out. If I went to the location bar of my browser and added/removed the WWW (to the way it had been before), all was well and I was still logged in. An incredibly thorny problem. I hope this post helps someone else fix it, or even better prevent it. I changed my hosting preferences to automatically add a WWW to my domain if it wasn't typed that way. thanks, Cory Forsyth ---- Server IP: 216.194.113.175 Probable Submitter: 216.165.95.5 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/ref.session.php Edit -- http://master.php.net/note/edit/65854 Del: integrated -- http://master.php.net/note/delete/65854/integrated Del: useless -- http://master.php.net/note/delete/65854/useless Del: bad code -- http://master.php.net/note/delete/65854/bad+code Del: spam -- http://master.php.net/note/delete/65854/spam Del: non-english -- http://master.php.net/note/delete/65854/non-english Del: in docs -- http://master.php.net/note/delete/65854/in+docs Del: other reasons-- http://master.php.net/note/delete/65854 Reject -- http://master.php.net/note/reject/65854 Search -- http://master.php.net/manage/user-notes.php