PHP Session change name

0
votes

I have some problems with my php login system.

I am trying to make better way to start session. I followed a tutorial from internet and the code sounds like this:

function initiazaSesiune()
{
 $secure = 'SECURE'; 
 $httponly = 'true';

// Fortam folosirea COOKIE
if (ini_set('session.use_only_cookies', 1) === FALSE) {
    echo 'ERROR NO COOKIE';
    exit();
}

$cookieParams = session_get_cookie_params(); 
session_set_cookie_params($cookieParams["lifetime"],
    $cookieParams["path"], 
    $cookieParams["domain"], 
    $secure,
    $httponly);

session_name("test");
session_start(); 
session_regenerate_id(true);

}

My login page sounds like this:

1) check if logged in (show 0.1 for $_SESSION variables not being set ||| 0.2 if the variable $_SESSION['logged_in'] is not 1 (true) ||| 0.3 if in database the account doesn't show to be logged in. ||| 1 if the account is logged in

2) set the $_SESSION if user credentials are valid

3) call again the function from 1).

The logout page:

session_start();
session_unset();
session_destroy();
session_write_close();

In this shape when I use valid credentials the login page shows: 0.11 which means user was not logged in when he started the authentication, the program set the inserted values because they were correct and 1 because saved values were valid comparing to the one in database.

If I refresh this page I get again 0.11 which is not correct because the user was logged in when I started again the process. It should have shown 11.

If I eliminate session_name and session_regenerate_id, everything works ok. First it shows 0.11 and then 11.

If I put sestion_name and sesion_regenerate_id and I delete session_set_cookie_params everything works ok again, first is shows 0.11 and then 1...

What have I done wrong?

1
phploginsession-cookies

1 Answers

0
votes

Move your session_name() above settings

An idea I suspected might be the issue, then I found some ones comment below.

Move your session name above where you session_get_cookie_params() or maybe as far up as above your ini_set()

This is not something I can easily test but I would try the following suggestion from the comments of the php documentation of session_set_cookie_params():

i found it somewhat difficult to work with sessions due to the documentation not really denoting the necessity for the session name to be set via session_name() in order for session_set_cookie_params() to be of any use. i found no reference to session_name() in this article, and my session functions would have been a disastrous mess were it not for a friend familiar with session.

so, in essence, for anybody wondering about where to start: declare a session name before using session_set_cookie_params(), otherwise you might agitate php to the point of committing some atrocity against your webserver.

Like this:

function initiazaSesiune()
{
 $secure = 'SECURE'; 
 $httponly = 'true';
 
 session_name("test");  // Moved above any settings

// Fortam folosirea COOKIE
if (ini_set('session.use_only_cookies', 1) === FALSE) {
    echo 'ERROR NO COOKIE';
    exit();
}

$cookieParams = session_get_cookie_params(); 
session_set_cookie_params($cookieParams["lifetime"],
    $cookieParams["path"], 
    $cookieParams["domain"], 
    $secure,
    $httponly);

session_start(); 
session_regenerate_id(true);

}