session id is changing 1

[jlarysz]

I am using PHP with Apache, and I use session id's to manage the data associated with a user session. The problem I have is that at one point I go out to PayPal, giving Paypal a return URL. When the session comes back to my page, the session id as reported by session_id() has changed!

All my pages contain the code:

session_start();
$Session_State = session_register("MySession"

$Session_State come back TRUE.

When I run session_get_cookie_params(), all I get is:

lifetime=0
path=/
domain=
secure=

What is happening here?

 

[sleipnir214]

Is the session cookie being set on the browser before the redirection to PayPal?

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[hos2]

and if you register the session again after the page is reloaded, then the session id is changed again

 

[jlarysz]

I don't know. What do I have to do to set it, and what does this do?

 

[jlarysz]

Yes, I register the session every time the page is called up. I do that throught the site, and it doesn't chnage the session id. It only seems to be changing when I move to a page outside the site, and then move back again.

 

[sleipnir214]

If a session cookie was handed to PHP when the script was invoked, then PHP will reuse the session ID stored in it.

However, session IDs can be passed in PHP in either of two ways: cookies and URLs.

If your PHP installation is using cookies, the session-handling mechanism will automatically set the cookie for you. You should be able to view the cookie store of your browser to see that the cookie was set and what its value is.

If your PHP installation is passing session IDs in the URL, then they won't work when you send users to PayPal and back.

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[jlarysz]

How can I find out how the session ID is being passed? I don't own the HTTPD server, but I can get changes made to its configuration.

 

[sleipnir214]

Whether PHP uses cookies or URLs to pass session IDs is determined by the php.ini configuration directive session.use_trans_sid. If this is set to 0, PHP uses cookies. You can get this value by looking at the output of phpinfo().

Also, if you're passing session IDs via the URL, you will see them in the URL.

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[jlarysz]

The host site has session.trans_use_sid = Off, so I guess that is the same as 0. The session id should be set correctly.

Odd.

I was really hopeful there. Shucks.

 

[sleipnir214]

Is PHP setting the cookie which stores the session ID?

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[jlarysz]

I think that it must be. All I do is issue session_start() and session_register() instructions.

 

[sleipnir214]

Never assume. Verify.

Examine the cookie store of your browser. Does the cookie exist?

Also, since PHP version 4.1.0, the preferred method of using session data is through manipulation of the $_SESSION superglobal array rather than through the use of session_register().

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[jlarysz]

OK, I've cracked it. It was plain old dumb programming - again. It's a long code page - I was issuing the session_register() function twice.

Thanks for all the help - it made me look at the code all over again.

 

[sleipnir214]

That's odd. Neither multiple invokations of session_register() nor multiple invokations of session_start() should affect the session id.

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[jlarysz]

Now I'm baffled again. I seem to be getting a reliable session_id at the moment, but I've no idea why.

I guess I'll have to wait for it to break again and keep looking.

 

[ingresman]

I recall something odd with the behaviour of session settings if register_globals isset to off, you have to use the $_SESSION array instead of the session_register()function.
Alternativly I wonder if paypal is written in php and its destryoing your session as well as its own (just a thought). You can change the name of the cookie if required if this is the case.

 

[jlarysz]

It seems to working correctly since I removed the second call to session_register(). I don't understand it either.