php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #69006 cookie problem
Submitted: 2015-02-07 16:56 UTC Modified: 2015-02-22 07:08 UTC
From: simon_freedom125 at hotmail dot com Assigned:
Status: Not a bug Package: Session related
PHP Version: 5.6.5 OS: windows
Private report: No CVE-ID: None
 [2015-02-07 16:56 UTC] simon_freedom125 at hotmail dot com
Description:
------------
The actual version of php is actually 5.6.3

The session does not persist when I set cookie for the session id to last not until the browser is closed. example, to last for a day.
When the session id is set to last until the browser is closed, the session start works on subsequent page request.

Tested on 3 browsers - chrome, mozilla, and IE. This only happens on IE.
realized this problem after upgrading from php 5.4+

I used the session_name function to change the default, so I am not using PHPSESSID. Not sure what is the actual cause.

Test script:
---------------
session_name('sessionID');
setcookie('sessionID',$sessionID,time()+3600*24,'/',NULL,true);


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-02-07 18:18 UTC] yohgaki@php.net
-Status: Open +Status: Feedback
 [2015-02-07 18:18 UTC] yohgaki@php.net
Why do you set cookie by yourself? It should be done by session module.
Use session_set_cookie_params() and session_start().

If you're enabling session.use_strict_mode (i.e. session.use_strice_mode=On), disable it to set your own ID. Beware that you are less secure with session.use_strit_mode=Off.

If you need to use certain session ID to share under use_strict_mode=on, get already initialized session ID after session_start() and use it.

This should solve your issue.
 [2015-02-07 18:32 UTC] yohgaki@php.net
Regardless of session.use_strict_mode, following code should work

session_name('MYSESS1');
session_id('2342424234242424323423');
session_set_cookie_params( some params);
session_start();
//do something. Copy $_SESSION to other var, if needed.
session_commit();

session_name('MYSESS2');
session_id('abasdfasdasbafdewra');
session_set_cookie_params( some params);
session_start();
 [2015-02-07 18:34 UTC] yohgaki@php.net
Correction.

> Regardless of session.use_strict_mode,

session.use_strict_mode=Off required.
 [2015-02-08 00:55 UTC] simon_freedom125 at hotmail dot com
I don't think it is a problem with session_set_cookie_params(). lets say i set 3 different cookies to last for a day. only the sessionID which I renamed away from the default of PHPSESSID does not persist.

Just another clearer example. I created a script which allows user to log into their account. A user check remember me so the script extend the cookie time. A total of 3 cookies named, sessionID, name, and a random value, with the same expiry time were given to the client browser. Now, everything is still fine over here.

Bug happens after the user clicked log in and then chose to proceed to another request after being redirected from the log in page, like a refresh or clicking on another link. when I called $_COOKIE['sessionID'], undefined call to sessionID error was shown on the screen. Surprising, only the sessionID cookie was affected. The other 2 can be seen in the browser cookie. Not opting remember me will solve the problem, which is weird, only on IE.
 [2015-02-08 03:34 UTC] simon_freedom125 at hotmail dot com
-Summary: session fail to start? +Summary: cookie problem -Status: Feedback +Status: Open
 [2015-02-08 03:34 UTC] simon_freedom125 at hotmail dot com
Description:
------------
The actual version of php is actually 5.6.3

The session does not persist when I set cookie for the session id to last not until the browser is closed. example, to last for a day.
When the session id is set to last until the browser is closed, the session start works on subsequent page request.

Tested on 3 browsers - chrome, mozilla, and IE. This only happens on IE.
realized this problem after upgrading from php 5.4+

I used the session_name function to change the default, so I am not using PHPSESSID. Not sure what is the actual cause.

Test script:
---------------
session_name('sessionID');
setcookie('sessionID',$sessionID,time()+3600*24,'/',NULL,true);
 [2015-02-08 05:40 UTC] yohgaki@php.net
Have you tried what I wrote?
Why your test script does not have session_start()?
W/o session_start(), session is useless.
 [2015-02-08 05:40 UTC] yohgaki@php.net
-Status: Open +Status: Feedback
 [2015-02-08 13:10 UTC] simon_freedom125 at hotmail dot com
of course I did a session start. Otherwise, I would not be giving a description that it works when a user did not check the 'remember me'.

Tried your method with session_set_cookie_params( some params), did not work as well. It's not like I mess with the settings of IE, strange.
 [2015-02-11 01:13 UTC] simon_freedom125 at hotmail dot com
Ok, I was hoping I did something wrong so I decided to give your method another try. The results were slightly different this time, chrome, mozilla, and IE manage to maintain the session on subsequent click on the same website.

But, now all the browser failed to register the extended time which was given to last even after until a browser is closed, like with the following: 

session_set_cookie_params(time()+3600*24,'/',NULL,TRUE);
 [2015-02-11 01:33 UTC] rasmus@php.net
Cookies are super-easy to debug. Just look at the Set-Cookie header in the response. What the browsers are doing is not relevant here. If you have the right cookie name and the expiry is correct, then PHP is doing its job. Anything else has nothing to do with PHP. So, please restate the bug in terms of the Set-Cookie output you are getting and explain why it is not what you expected.
 [2015-02-13 06:18 UTC] simon_freedom125 at hotmail dot com
Ok, so i heed your advice and use mainly 2 functions, correct me if those are not what your were referring to or if there are more which I am still unaware of:

var_dump(headers_list());
var_dump(http_response_code());

The headers list printed out fine as it is supposed to.
The http_response_code() which I called immediately after setting the sessionID  cookie returned int(200), looks like things are fine in php like you mentioned.

So the problem probably lies in IE, as I happened to accidentally resolved the issue after noticing the problem is gone after I clicked 'enter' at least 3 times to separate the redirection header from the setcookie function. Apparently, doing echo "\r\n"; will solve the issue as well.
 [2015-02-13 11:16 UTC] simon_freedom125 at hotmail dot com
somehow, the solution which I provided suddenly does not work anymore. Since I don't see anybody having the same problem, should be a case on my code.
 [2015-02-22 04:22 UTC] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
 [2015-02-22 07:08 UTC] requinix@php.net
-Status: No Feedback +Status: Not a bug
 [2015-02-22 07:08 UTC] requinix@php.net
NABing based on the comments
>So the problem probably lies in IE,
and
>I don't see anybody having the same problem, should be a case on my code.

(say something if you disagree)
 [2016-03-18 10:04 UTC] lokendra dot kushwah at galaxyweblinks dot in
We are facing same issue in PHP 5.6.3
Can you please help ?
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Apr 18 16:01:29 2024 UTC