PHP Session lost after redirecting

Question

Really annoying problem I can't solve/can only partially solve. Nice juicy one for you pros.

I've got a basic login system set up. Like this:

Login.php:

line 1: session_start();
Check if($_SESSION['logged_in'] == true) header("Location: /controls.php);, incase they've already entered their details.
If they haven't entered them yet, user enters credentials, if valid: $_SESSION['logged_in'] = true;
After database credentials are checked and session is set to true, redirect using PHP header("Location: /controls.php);

Bear in mind, the session is now set.

Controls.php

line 1: session_start();
line 2: if($_SESSION['logged_in'] != true) {header("Location: /index.php");}

Instantly I get taken to index.php ONLY IN CHROME AND FIREFOX.

Also, I have accounttools.php, where the session is again required. Once I try to access accounttools.php, the session is destroyed/unset and any attempt to load accounttools.php results in the header redirect to my /index.php page, again ONLY IN FIREFOX AND CHROME.

I've also got to add in something. If I go back to login.php and re-login, everything works fine and the session gets set properly. Is this a browser-based bug? PHP is executed before any data gets sent to the browser, so how on earth can these browsers act differently if the PHP has already been executed by the time anything reaches the user?

Login file:

// Login.php
<?php session_start();

if($_SESSION['logged_in'] == true)
{
    header("Location: /controls.php");
    exit();
}

if($_POST['username_login'] && $_POST['password_login'])
{
    // Do necessary database work to check credentials (edited out here).
    // ...    
    // Check re-hashed pass against database hash (password checking)
    if($make_password == $current_user[0]['password'])
    {
        // If this is OK login is a success.
        $_SESSION['logged_in'] = true;
        header("Location: /controls.php");
        exit();
    }
}
?>

Controls file:

// controls.php
// This page instantly redirects to index.php
<?php session_start();

// Go to homepage if logging out.
if($_POST['logging_out']) 
{
    unset($_SESSION['logged_in']); 
    header("Location: /index.php"); 
    exit();
} 
// No access unless logged in.
// This session seems to no longer exist at this point. Why??
if($_SESSION['logged_in'] != true)
{
    header("Location: /index.php");
    exit();
}
?>

Edit: I've discovered something else: If I login and manually enter the URL of the $_SESSION-restricted page, the $_SESSION is not destroyed.

There is some part of the header() redirect that is causing th $_SESSION to become unset/destroyed in Google and Mozilla.

I've also been Googling like crazy and apparently this is a common problem amongs PHP coders. Someone must have a clue what this is?

Two questions: 1) Why are you closing and opening your PHP tags after your session_start(), and 2) on your login page, why are you outputting a script to redirect when you could just use the Location header? I assume you have some output somewhere before line 400, but that doesn't really make sense either, as your login checking should really be right at the beginning of the script. — SenorAmor
They all look like relative redirects but I have to ask - are you bouncing between HTTP & HTTPS? You aren't moving between domains (even www. to non www.)? And you haven't disabled cookies? — John C
John C: I'm not switching between HTTP & HTTPS, all is on the same domain and same directory. SenoAmor: I don't know why I did that, was a copy/paste job. I've now modified my login.php file to use the header() redirect in PHP, and have moved my login checks to the beginning of the file. However, I'm still losing the session between the two pages. — George88

jeroen jeroen · Accepted Answer · 2012-07-12T01:19:44

I see a problem with the way you are redirecting after a successful login: It is a javascript redirect so it will only happen after all the php has finished executing and the result has been sent to the browser. That means that codes after your redirect are executed as well.

I would recommend not outputting anything to the browser until the very end and use the:

header("Location: /...");
exit();

combination everywhere where you want to redirect so that you are sure that nothing happens to your session after the redirect code.

To avoid getting headers already sent problems, I would also recommend getting rid of stuff like:

?>
<?php

like on the first lines of login.php.

PHP Session lost after redirecting

1 Answers