Session problems - firewall to blame

[jimoblak]

I am having trouble with sessions with my company's internet connection to a remote server. I can connect to the web site and properly use sessions at any other location (ex: home) but when accessing the site through a firewall at work, the session data is not being saved.

Can anyone give me some ideas how to correct this?

Does a firewall have the ability to affect session data transfer?

I am not the admin for my company's firewall so I cannot tell what the configuration is. I need to relay what I learn to our admin so that he can fix this. He is not well-versed in session handling.

- - picklefish - -
Why is everyone in this forum responding to me as picklefish?

 

[sleipnir214]

Sure it's possible. If the firewall were doing some kind of inspection of HTTP packets.

Are you sure, though, that it's not a browser configuration problem? Have you tried multiple brands of browsers?


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[sleipnir214]

ADDENDUM:

What about web proxies at your place of work?


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[jimoblak]

Yes, I have tried on several browsers (Gecko & IE) and set IE's security to the minimum in case IE was blocking something. I am using the same browsers at work that I successfully use at home.

'Firewall' is used here synonymously with 'proxy'. We are using Novell BorderManager, if that info helps.

Does session data get transferred on anything other than port 80? could that be at issue?

I also wonder if the firewall/proxy is bouncing the client's IP address around, making it difficult to maintain a single session connection.

- - picklefish - -
Why is everyone in this forum responding to me as picklefish?

 

[sleipnir214]

See my FAQ titled, "The events that take place when you issue session_start() in your script." (faq434-4908).

The session token that gets passed from PHP to your browser and back is stored in a cookie. Cookies are sent on the same connection that sends a page, in HTTP headers. There would be no additional port.

I'd bet that BorderManager is stripping the session cookie right out of the server response that sends the page. Check the raw page data by connecting to the server through telnet -- see section 2.6 of my FAQ titled "Debugging PHP code" (faq434-2999).


Want the best answers? Ask the best questions!

TANSTAAFL!!