Session problem

[pease]

Morning (or afternoon depending on where you are!)

I have a problem with a very basic session script.

I have two pages, page1 and page2, for debugging purposes currently each page starts with

session_start();
if(!isset($_SESSION['userid'])) {
echo "no session";
} else {
//do code for page....

On the login page I set the cookie using

Setcookie("userid","This is my test cookie");

when I login and move to page 2 it acts as if the session is not set and displays "no session"

I thought the cookie wasnt setting or being carried over so I changed the echo "no session" to

echo $_COOKIE["userid"];

expecting it to come back blank, it didnt, the cookie displayed exactly what I expected it to (in this case "this is my test cookie").

Im now lost??????

 

[jpadie]

$_COOKIE and $_SESSION are two separate things. a session is a set of server stored information. typically this is stored as a serialized array in the file system and identified by a unique id which is transmitted to the client by way of a cookie. thus the only thing a client knows about a session is the id.

so, setting a COOKIE with the name userid and an arbitrary value will not help you at all. you must set a session variable instead

$_SESSION['userid'] = 'somevalue';

remember to make sure that the session store folder is read-writable by the php process.

and if you are testing on a local machine or a very slow server then you might find that session data appears not to be stored properly. in which case call session_write_close() after you have finished manipulating your session data.

 

[DonQuichote]

And don't forget to change to a new session upon login, to avoid the possibility of session fixation.

(see

http://en.wikipedia.org/wiki/Session_fixation

and

http://www.php.net/manual/en/function.session-regenerate-id.php)

+++ Despite being wrong in every important aspect, that is a very good analogy +++
Hex (in Darwin's Watch)

 

[jpadie]

session id's are stored in cookies for php (unless you are using TRANSID). is session fixation really an issue? has anyone god examples of an attack vector exploiting session fixation via php cookie-stored sessions?