PHP Session variable lost after refresh / redirect

Question

I am making login page and everything works fine, but while refreshing secure page or redirecting to another page variable disappears.

Login:

<?php session_start(); 

//connection to database and other stuff

if ($user == $dbuser && $pass == $dbpass) {

    $_SESSION['user'] = $user;
    $_SESSION['authenticated'] = "yes";
    $suser = $_SESSION['user']; //just to test if session works

}

?>

Secure page:

<?php session_start(); ?>

//small amount of html here

<?php
    $suser = $_SESSION['user'];
    $sauth = $_SESSION['authenticated'];

    if ($sauth != 'yes') { //not completed yet (needs user name check)
        echo "<a href='./'>Log in</a> first!";
        require ('./login.php');
        die;
    } else {
    //not so important code here
    }
?>

//rest of html here

I didn't notice any mistakes and error log file is clean so it must be something else. Session works fine after redirecting to secure page but as I said earlier refresh of page or another redirect clears session variables.

Page: http://nano.filiparag.com/admin/ If you want to test it just ask for username and password

Note:
Now I tried doing this with setcookie() and it didn't work again

Solved

The problem was in logout button. I made separate PHP file for it and now everything works fine.

Are $dbuser and $dbpass always defined? If they aren't, then that if block would return true since all 4 variables could be undefined/falsey. That would overwrite your $_SESSION['user'] and $_SESSION['authenticated'] values. — jraede
@jraede Don't worry about db* because they are always defined - picked up from database. — Filip Parag
Are you positive? From your code that's the only thing I can see that would log the person out. Posting more code might help, as would an explanation of how you redirect them to the secure page after logging in. — jraede
@jraede Database connection is code above if statement in Login page. They get message 'Loged in as example' and an link to click for redirection. Login form calls (action) itself (same file). — Filip Parag
check if the session id is changing. if it is the cookie is not set in your browser. — redshark1802

Gman Gman · Accepted Answer · 2014-02-21T19:35:46

I think you can try using this

Login:

<?php session_start(); 
ob_start();
//connection to database and other stuff

if ($user == $dbuser && $pass == $dbpass) {

    $_SESSION['user'] = $user;
    $_SESSION['authenticated'] = "yes";
    $suser = $_SESSION['user']; //just to test if session works

}

?>

Secure page:

<?php session_start(); 
  ob_start();?>

//small amount of html here
<?php session_start(); ob_start();
    $suser = $_SESSION['user'];
    $sauth = $_SESSION['authenticated'];

    if ($sauth != 'yes') { //not completed yet (needs user name check)
        echo "<a href='./'>Log in</a> first!";
        require ('./login.php');
        die;
    } else {
    //not so important code here
    }
?>

//rest of html here

PHP Session variable lost after refresh / redirect

Solved

2 Answers