php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #39739 session_start() doesnt check if there is a duplicate cookie
Submitted: 2006-12-05 02:50 UTC Modified: 2006-12-05 09:58 UTC
From: cameron dot brunner at gmail dot com Assigned:
Status: Not a bug Package: Session related
PHP Version: 5CVS-2006-12-05 (CVS) OS: Gentoo Linux
Private report: No CVE-ID: None
 [2006-12-05 02:50 UTC] cameron dot brunner at gmail dot com
Description:
------------
php seems to fail to check if there is already a setcookie for the session in the queue and puts the same thing in again

Reproduce code:
---------------
<?php
ob_start();

session_start();
$id = session_id();

$_SESSION['asdf'] = 123;

var_dump($_SESSION);
session_write_close();

$_SESSION['asdff'] = 234;

var_dump($_SESSION);
session_start($id);

$_SESSION['a'] = 'b';

var_dump($_SESSION);
session_write_close();

var_dump($_SESSION);


Expected result:
----------------
X-Powered-By: PHP/5.2.1-dev
Set-Cookie: PHPSESSID=h00e0fl7o9ilgifoluqh8kdbg1; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-type: text/html

array(1) {
  ["asdf"]=>
  int(123)
}
array(2) {
  ["asdf"]=>
  int(123)
  ["asdff"]=>
  int(234)
}
array(2) {
  ["asdf"]=>
  int(123)
  ["a"]=>
  string(1) "b"
}
array(2) {
  ["asdf"]=>
  int(123)
  ["a"]=>
  string(1) "b"
}


Actual result:
--------------
X-Powered-By: PHP/5.2.1-dev
Set-Cookie: PHPSESSID=h00e0fl7o9ilgifoluqh8kdbg1; path=/
Set-Cookie: PHPSESSID=h00e0fl7o9ilgifoluqh8kdbg1; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-type: text/html

array(1) {
  ["asdf"]=>
  int(123)
}
array(2) {
  ["asdf"]=>
  int(123)
  ["asdff"]=>
  int(234)
}
array(2) {
  ["asdf"]=>
  int(123)
  ["a"]=>
  string(1) "b"
}
array(2) {
  ["asdf"]=>
  int(123)
  ["a"]=>
  string(1) "b"
}


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-12-05 02:59 UTC] gavin at vess dot com
Also, when using cookies for session id's, and the user agent has no session cookie, invoking start_session(), later followed by session_regenerate_id(), we also end up with two session cookies.  The same occurs with duplicate calls to session_regenerate_id().  Most user agents only use the last one.

Sure, we could make userland code smarter to avoid regenerating an id, after session_start() by using session_id() first, but some userland code requires extensive refactoring -e.g. to eliminate duplicate calls to session_regenerate_id().
 [2006-12-05 09:58 UTC] tony2001@php.net
Duplicate of bug #38104.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat May 18 08:01:33 2024 UTC