[RESOLVED] $_SESSIONS not working with cookies disabled

@lukazDec 15.2009

Hi,
When I disable cookies in my browser, my site stops working, I am using $_SESSION variables alot, but no actual cookies. When I say my site stops working, things like not being able to log in, not sticky forms. Is there anyway to ensure my site will keep working with cookies turned off?

Cheers
Luke

to post a comment

PHP

@SrWebDeveloperDec 15.2009 — #Run phpinfo() or examine php.ini and check your sessions settings, most notably these two:

session.save_path (default is blank, otherwise set a /path/ PHP can write to, don't use /tmp on Linux so sessions can't be hijacked)

session.use_only_cookies (default is 1 since PHP 5.3.0, specifies whether the module will [I]only[/I] use cookies to store the session id on the client side - change to 0 in your situation)

Edit your php.ini accordingly - remember to restart your web server if you run PHP as a module, after any changes. If this does not solve your problem, need relevant session code.

-jim

@lukazauthorDec 15.2009 — #Hi Jim

Thanks for the quick reply, I can't change the server configiration right now, but i tried ini_set('session.use-only-cookies', 0); in my config file, should that work? or is that just me being hopeful? At the moment its not working so if its ment to work then I guess i need to dig into my code, but if im just being hopeful I will have to get the server config changed.

Cheers

Luke

EDIT: [I]after doing some more googleing it looks like the issue might be that session_id cannot be parsed without cookies present(or using SID in the url?). Is there anyway to get around this with php or do I need to tell the user to activate cookies to use the site?[/I]

@SrWebDeveloperDec 15.2009 — #All those session configuration options I listed can be changed at runtime in your script. FYI, the help page I linked say each is changeable type "PHP_INI_ALL" which in PHP means "entry can be set anywhere".

Anyway, you can still use phpinfo() to see the current session configuration settings and make adjustments. Just remember if you do something like set the session path yourself, use proper permissions on that folder.

As to cookies, you don't "need" them to pass a session ID. You can pass it as an argument on every URL and retrieve it via $_GET. There are other topics on this forum about session ID anti-hijacking security procedures to follow if you're smart, i.e. when to reset the ID, use a hash, store the ID on the server in either database or flat file, expire it properly and so on. PHP and session security is well documented on here and the Internet.

-jim

@lukazauthorDec 15.2009 — #Thanks Jim,

I will keep digging through the forum for relevant topics ?

Luke

[RESOLVED] $_SESSIONS not working with cookies disabled

4 Comments(s) _↴

Also in #PHP _↴

Success!

Social

Version

[RESOLVED] $_SESSIONS not working with cookies disabled

4 Comments(s) ↴

Also in #PHP ↴

Success!

The web is an endless sea of information. Don't miss the boat... Subscribe!

Social

Version

4 Comments(s) _↴

Also in #PHP _↴