php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #17704 When the cookie on the client expires, the sessiongets messy
Submitted: 2002-06-11 12:11 UTC Modified: 2002-06-13 14:39 UTC
Votes:1
Avg. Score:4.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: thiago at softexpert dot com Assigned:
Status: Not a bug Package: Session related
PHP Version: 4.2.1 OS: Windows 2000
Private report: No CVE-ID: None
 [2002-06-11 12:11 UTC] thiago at softexpert dot com
Try this steps:

1 - Clear the session_save_path dir.
2 - Create a session with expires=0
3 - Destroy this session
4 - Close the browser (I.E)
5 - Open the browser and access the same page where the session was created

6 - Look at the session_save_path dir.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-06-11 12:20 UTC] thiago at softexpert dot com
Let me explain it better:
   
   I think the session_start() is not checking if the session is expired or not (or this checking is broken), so its creating more than one session_id. One with the expired ID and another with the new ID. A third ID is appearing too, but i dont know why. Im using session_name() before calling session_start() on all parts of the code.
 [2002-06-11 18:19 UTC] sniper@php.net
Not enough information was provided for us to be able
to handle this bug. Please re-read the instructions at
http://bugs.php.net/how-to-report.php

If you can provide more information, feel free to add it
to this bug and change the status back to "Open".

Thank you for your interest in PHP.



 [2002-06-11 22:04 UTC] thiago at softexpert dot com
Ok.. let me explain it better..

   I have a php script that creates a session with session_name() and session_start(). This session is created with the default cookie expire option which is "expires when the browser is closed". At the end of this script (actually, its more than 1 file) the session is destroyed with session_destroy(). When i execute (run) this script again (same code) it creates 2 session ID on my session_save_path (where session data is saved). One ID is the old expired ID and the other is the new ID. The session data is stored on the old ID (the expired one) and $_SESSION["var"] is read from the new ID. It doesnt return the expected value because the value is on the old expired ID that shouldnt be created again.

This happens when i close the browser (making the session cookie expire) before executing (running) the script for the second time. If i execute (run) it without closing the browser, it justs creates the same ID and works fine which is the expected behaviour because the cooking isnt expired.

So, the thing is, php is creating sessions based on expired session cookies and its getting lost too because its making the expired (old) sessions live again and its creating the new session too. And everything gets messy.

Im using Windows 2000 with php 4.2.1. I tested it with I.E 6.0 and with Mozilla 1.0. The web-server is IIS 5 with CGI.

register_globals is off.


Is it clear enought ?
thank you very much.
 [2002-06-11 22:08 UTC] thiago at softexpert dot com
reopening it.. hope its better now :)
 [2002-06-11 22:11 UTC] thiago at softexpert dot com
i wrote cooking, but i mean cookie.

and im using NTFS filesystem.
 [2002-06-12 08:55 UTC] sniper@php.net
What I was expecting was a short and complete example
script which can be used to reproduce this..

 [2002-06-13 12:41 UTC] thiago at softexpert dot com
Closin this BUG. The error was caused because i was using header() after session_start(). Im sure its after :)
 [2002-06-13 13:13 UTC] derick@php.net
Sorry, but the bug system is not the appropriate forum for asking
support questions. Your problem does not imply a bug in PHP itself.
For a list of more appropriate places to ask for help using PHP,
please visit http://www.php.net/support.php

Thank you for your interest in PHP.


 [2002-06-13 13:58 UTC] thiago at softexpert dot com
I didnt ask anything!!

Its already on another bug, so i closed it.. end of story.. AND STOP PASTING THIS STUPID MESSAGE. I ALWAYS SEE THIS WHERE PEOPLE DIDNT ASK ANYTHING. Sorry, im a little temperamental. 
Thanks for your interest in php.
 [2002-06-13 14:00 UTC] thiago at softexpert dot com
close!!
 [2002-06-13 14:39 UTC] derick@php.net
Dude, this is an automated message to say that it was a user problem, and not a bug in PHP. If it's not a bug the status should be bogus, which it is now again.

Derick
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Apr 26 13:01:28 2024 UTC