|
|
Posted by fletch on 04/25/06 10:11
> The basic problem: session data (e.g. $_SESSION['access_level']) gets
> dropped after visitor logs in and reloads the page via a form once or
> twice (it seems to vary), requiring the visitor to re-login, whereupon
> the problem repeats itself.
The reason this happens is to do with the sessionid being lost. It is
either passed by cookie or by url. The first thing to check is that
session_start() is called before any output to the screen. Place a
die('.'); before the session_start() calls of you script and view
source. White space is considered output and is not allowed.
Assuming that didn't sort things out then the next step is to check
that the sessionid is being passed. First check your cookies, and see
if there's one there. Then turn off cookies to force the sessionid to
be passed by url. There are some circumstances (although I can't of the
top of my head remember what they are) where PHP fails to add the
?PHPSESSID=xxx to a url. If there is nothing really odd about your
script (like running everything through exec()) then this step is
probably a waste of time as it will work.
> I use session_regenerate_id to avoid session fixation. Could this be a factor?
Yes. I don't see the need for it for one, and according to the comments
in the manual other people are losing session info because of it.
Navigation:
[Reply to this message]
|