PHP Sessions across sub domains

Question

I am trying to set up the following:

auth.example.com
sub1.example.com
sub2.example.com

If the user visits sub1.example.com or sub2.example.com and they are not logged in, they get redirected over to auth.example.com and can log in.

sub1.example.com and sub2.example.com are two separate applications but use the same credentials.

I tried setting the following in my php.ini:

session.cookie_domain = ".example.com"

but it doesn't seem to be passing the information from one domain to the other.

[Edit]

I tried the following:

sub1.example.com/test.php

session_set_cookie_params(0, '/', '.example.com');
session_start();
print session_id() . "<br>";
$_SESSION['Regsitered'] = 1;
echo '<a href="http://auth.example.com/test.php">Change Sites</a>'

auth.example.com/test.php

session_set_cookie_params(0, '/', '.example.com');
session_start();
print session_id() . "<br>";
$_SESSION['Checked'] = 1;
print_r($_SESSION);

The session IDs are exactly the same but when I dump out the $_SESSION variable it doesn't show both keys, just whatever key I set under each domain.

You have to enable it in your code as well, see http://us2.php.net/manual/en/function.session-set-cookie-params.php — Residuum
– Residuum, Commented Jun 30, 2009 at 15:18
I have almost the same setup (I set the session cookie domain with a call to "session_set_cookie_params") and it works fine. — Milen A. Radev
– Milen A. Radev, Commented Jun 30, 2009 at 15:25
Here is nice function that works stackoverflow.com/questions/2835486/… — boksiora
– boksiora, Commented Jul 14, 2013 at 9:25

tripleee · Accepted Answer · 2024-05-13 09:05:58Z

147

I do not know if the problem still exists, but I just ran into the same problem and solved it setting a session name before calling session_set_cookie_params():

$some_name = session_name("some_name");
session_set_cookie_params(0, '/', '.example.com');
session_start();

I have changed nothing in my php.ini but now everything is working fine.

edited May 13, 2024 at 9:05

tripleee

192k37 gold badges318 silver badges367 bronze badges

answered Sep 22, 2009 at 0:35

jeroen

91.8k22 gold badges117 silver badges132 bronze badges

Sign up to request clarification or add additional context in comments.

14 Comments

Roman Over a year ago

I confirm, it solves the problem. I tired to get my answer there: stackoverflow.com/questions/4948340/…. But I found it here.

Kit Over a year ago

Works perfect! Been looking for ages for this. It was the $some_name = session_name("some_name"); that did it. Thank you and upvote.

David Carroll Over a year ago

Adding session_name("domain"); was the missing ingredient for me as well. The documentation on php.net regarding these session settings are lacking. There are community posts on php.net that indicate session.name needs to be defined before changes to session_set_cookie_params() can be applied.

Daithí Over a year ago

yep. confirmed. nice one was going around in circles for ages there ;)

Jānis Elmeris Over a year ago

session_name() was not needed for me in a case where the cookie_domain was set to ".domain.com" from the beginning (of using the website). As I see it, what it does is getting around the problem that a user already has a PHPSESSID (standard session name) cookie stored for the subdomains, so even if I come from another subdomain with a new ".domain.com" cookie, my already stored "sub.domain.com" cookie is used instead. Setting a different session name discards those old cookies.

|

Patrick Mevzek · Accepted Answer · 2019-08-02 22:17:43Z

24

One thing which can mysteriously prevent session data being read on a subdomain, despite cookies being correctly set to .example.com is the PHP Suhosin patch. You can have everything configured correctly, as per the examples in the question, and it can just not work.

Turn the following Suhosin session settings off, and you're back in business:

suhosin.session.cryptua = Off 
suhosin.session.cryptdocroot = Off

edited Aug 2, 2019 at 22:17

Patrick Mevzek

12.9k17 gold badges46 silver badges62 bronze badges

answered Jun 25, 2011 at 12:49

drewm

1,9781 gold badge17 silver badges23 bronze badges

Comments

Syed M. Sannan · Accepted Answer · 2022-12-11 22:33:25Z

6

Try using:

session.cookie_domain = "example.com"

Instead of:

session.cookie_domain = ".example.com"

Note the missing period at the beginning.

edited Dec 11, 2022 at 22:33

Syed M. Sannan

1,3924 gold badges15 silver badges34 bronze badges

answered Jun 30, 2009 at 15:17

George Claghorn

26.6k3 gold badges51 silver badges49 bronze badges

3 Comments

gawpertron Over a year ago

Which browsers are not supported?

Kuf Over a year ago

what browser support has to to here? this is a server side action.

Beyondo Over a year ago

For future readers, make sure to restart your php too, not only apache/nginx after this.

Valentin Florea · Accepted Answer · 2013-12-09 11:10:55Z

Had this exact problem - I wanted session values created on x.example.local to be available on example.local and vice-versa.

All solutions I found said to change the Session domain by using php_value session.cookie_domain .example.local in .htaccess (or via php.ini or via ini_set).

The catch was I was setting the session.cookie_domain for all subdomains (so far ok) but also for the main domain. Setting the session.cookie_domain on the main domain is apparently a no-no.

Basically the way it worked for me:

set the session.cookie_domain for ALL SUBDOMAINS.
don't set it for the main DOMAIN

Oh yes, please make sure the domain has a TLD (in my case .local). Http protocol doesn't allow cookies/sessions to be stored on a domain without .tld (ie localhost won't work, but stuff.localhost will).

EDIT: Also make sure you always clear your browser cookies while testing/debugging sessions across subdomains. If you don't, your browser will always send the old session cookie which probably doesn't have the correct cookie_domain set yet. The server will revive the old session and therefore you'll get false negative results. (in many posts it's mentioned to use session_name('stuff') for the exact same effect)

Patrick Mevzek · Accepted Answer · 2019-08-02 22:16:25Z

3

I solved it like this

ini_set('session.cookie_domain', '.testdomain.example');
session_start();

Because I was working on localhost

ini_set('session.cookie_domain', '.localhost');

wasn't working, it sees .localhost as the toplevel instead of .com/.local/... (I suspect)

edited Aug 2, 2019 at 22:16

Patrick Mevzek

12.9k17 gold badges46 silver badges62 bronze badges

answered Apr 12, 2012 at 17:27

xtds

2,5332 gold badges19 silver badges13 bronze badges

1 Comment

dennis Over a year ago

Also fixed it for my machine - Ubuntu 14.04

BadHorsie · Accepted Answer · 2019-10-24 22:12:13Z

I have confirmed. joreon's answer is correct. I cannot comment because my reputation is not enough so I post my comment here.

Define the constant in a config file. If you want to change it, no need to modify whole files.

define('ROOT_DOMAIN',   'mysite.example');
define('PHP_SESSION_NAME', 'MYSITE');

The session name can't consist of digits only, at least one letter must be present. Otherwise, a new session id is generated every time.

Use the following code to start using session

session_name(PHP_SESSION_NAME);
session_set_cookie_params(0, '/', '.' . ROOT_DOMAIN);
session_start();

I'm using this function:

function load_session() {
    if (session_status() == PHP_SESSION_NONE) {
        session_name(PHP_SESSION_NAME);
        session_set_cookie_params(0, '/', '.' . ROOT_DOMAIN);
        session_start();
    } elseif (session_name() != PHP_SESSION_NAME) {
        session_destroy();
        session_name(PHP_SESSION_NAME);
        session_set_cookie_params(0, '/', '.' . ROOT_DOMAIN);
        session_start();
    }
}
load_session(); // put it in anywhere you want to use session

dove · Accepted Answer · 2012-12-10 16:25:10Z

2

Use this , it works:

ini_set('session.cookie_domain', 
    substr($_SERVER['SERVER_NAME'],strpos($_SERVER['SERVER_NAME'],"."),100));

edited Dec 10, 2012 at 16:25

dove

20.8k14 gold badges88 silver badges109 bronze badges

answered Oct 5, 2010 at 20:22

Ivan

211 bronze badge

1 Comment

chacham15 Over a year ago

this looks like its setting the cookie for the tld...or am i missing something?

Patrick Mevzek · Accepted Answer · 2019-08-02 22:14:17Z

1

Sub domain and root domain Cookie Sessions Combined Use

Resource: http://php.net//manual/tr/function.session-set-cookie-params.php

I've tested works

sub.example.com/sessionadd.php?id=123

example.com/sessionview.php // 123

-- Codes

<?php 
$currentCookieParams = session_get_cookie_params(); 

$rootDomain = '.example.com'; 

session_set_cookie_params( 
    $currentCookieParams["lifetime"], 
    $currentCookieParams["path"], 
    $rootDomain, 
    $currentCookieParams["secure"], 
    $currentCookieParams["httponly"] 
); 

session_name('mysessionname'); 
session_start(); 

setcookie($cookieName, $cookieValue, time() + 3600, '/', $rootDomain); 
?>

edited Aug 2, 2019 at 22:14

Patrick Mevzek

12.9k17 gold badges46 silver badges62 bronze badges

answered Aug 28, 2014 at 16:26

Limitless isa

3,82238 silver badges29 bronze badges

Comments

Thomas · Accepted Answer · 2009-06-30 15:18:51Z

0

I get the idea that you don't want something like OpenID, like Joel is suggesting, but that you want to have access to the session data across multiple domains.

The only possibility that I can think of as a solution for that problem is to store the sessiondata in a database, and pull it out of that database.

answered Jun 30, 2009 at 15:18

Thomas

5,0494 gold badges26 silver badges20 bronze badges

1 Comment

dragonmantank Over a year ago

Right, while authentication is a part of what I want to do, I'm also interested in the session data that gets stored while the user is working.

Vic · Accepted Answer · 2016-07-26 20:23:14Z

0

I had a similar problem, however, this solution was good for me, perhaps will help others in the future

edit the php.ini

session.cookie_domain = ".example.com"

the magic is here

suhosin.session.cryptdocroot = Off

suhosin.cookie.cryptdocroot = Off

https://www.sitepoint.com/community/t/sessions-across-subdomains-domain-com-phpsessid-changes/3013/19

edited Jul 26, 2016 at 20:23

Vic

22.3k11 gold badges80 silver badges101 bronze badges

answered Jul 26, 2016 at 19:06

Willian Santana

414 bronze badges

Comments

Patrick Mevzek · Accepted Answer · 2019-08-02 22:13:14Z

0

I can't speak for other versions of PHP, but in 5.6.6, simply setting the session.cookie_domain value in the php.ini file did the trick to allow all of my subdomains on iPage to share the same set of session variables.

Be sure to remove any existing cookies related to your domain from your browser to test.

session.cookie_domain = '.yourdomainname.example'

Oh, don't know if it makes any difference but I'm also using session autostart.

session.auto_start = 1

edited Aug 2, 2019 at 22:13

Patrick Mevzek

12.9k17 gold badges46 silver badges62 bronze badges

answered Nov 3, 2016 at 17:13

user3232196

2173 silver badges5 bronze badges

Comments

Patrick Mevzek · Accepted Answer · 2019-08-02 22:14:29Z

0

Simply try using following code just above session_start() method

$sess_life_time = 21600; //in seconds
$sess_path = "/";
$sess_domain = ".example.com";
$sess_secure = true; // if you have secured session
$sess_httponly = true; // httponly flag

session_set_cookie_params($sess_life_time, $sess_path, $sess_domain, $sess_secure, $sess_httponly);

edited Aug 2, 2019 at 22:14

Patrick Mevzek

12.9k17 gold badges46 silver badges62 bronze badges

answered Jul 9, 2014 at 10:50

Dimensional Sys

4981 gold badge6 silver badges21 bronze badges

Comments

Patrick Mevzek · Accepted Answer · 2019-08-02 22:15:33Z

0

I have read all answers above, I think my answer is helpful for people googling this:

make sure the browsers send session cookie back to servers (of domain and sub-domains), set session cookie domain as .example.com.
Make sure PHP find the right "target" to restore the session variable:
- If domain and subdomains point to the same machine (maybe different virtual hosts), make sure session_save_path is the same for all (I tested)
- If domain and subdomains point to different machines, the common storage (like database) is best for saving and restoring session data (I didn't test yet). Use session_set_save_handler to do that.

edited Aug 2, 2019 at 22:15

Patrick Mevzek

12.9k17 gold badges46 silver badges62 bronze badges

answered Dec 21, 2012 at 3:55

user953985

1

Comments

Patrick Mevzek · Accepted Answer · 2019-08-02 22:17:00Z

I know this is old but this works fine for me with multiple domains and sub domains on the same box.

<?php
define('site_domain','example.com');
session_set_save_handler('_open',
                         '_close',
                         '_read',
                         '_write',
                         '_destroy',
                         '_clean');

function _open(){

    global $_sess_db;

$db_user = 'user';
$db_pass = 'pass';
$db_host = 'localhost';

if ($_sess_db = mysql_connect($db_host, $db_user, $db_pass)){

    return mysql_select_db('database', $_sess_db);

}

return false;

}

function _close(){

    global $_sess_db;
    return mysql_close($_sess_db);

}

function _read($id){

    global $_sess_db;
    $id = mysql_real_escape_string($id);
    $domain = mysql_real_escape_string(site_domain);
    $agent = mysql_real_escape_string(isset($_SERVER['HTTP_USER_AGENT']));

    $sql = "SELECT data
    FROM sessions
    WHERE id = '$id' AND domain = '$domain' AND agent = '$agent'";

     if ($result = mysql_query($sql, $_sess_db)){

         if (mysql_num_rows($result)){
             $record = mysql_fetch_assoc($result);
             return $record['data'];
        }

    }

    return '';

}

function _write($id, $data){

    global $_sess_db;
    $access = time();

    $id = mysql_real_escape_string($id);
    $access = mysql_real_escape_string($access);
    $data = mysql_real_escape_string($data);
    $domain = mysql_real_escape_string(site_domain);
    $agent = mysql_real_escape_string(isset($_SERVER['HTTP_USER_AGENT']));

    $sql = "REPLACE INTO sessions
    VALUES ('$id', '$access', '$data', '$domain', '$agent')";

    return mysql_query($sql, $_sess_db);

}

function _destroy($id){

    global $_sess_db;
    $id = mysql_real_escape_string($id);
    $domain = mysql_real_escape_string(site_domain);
    $agent = mysql_real_escape_string(isset($_SERVER['HTTP_USER_AGENT']));

    $sql = "DELETE FROM sessions
    WHERE id = '$id' AND domain = '$domain' AND agent = '$agent'";

    return mysql_query($sql, $_sess_db);

}

function _clean($max){

    global $_sess_db;
    $old = time() - $max;
    $old = mysql_real_escape_string($old);
    $domain = mysql_real_escape_string(site_domain);
    $agent = mysql_real_escape_string(isset($_SERVER['HTTP_USER_AGENT']));

    $sql = "DELETE FROM sessions
    WHERE  access < '$old' AND domain = '$domain' AND agent = '$agent'";

    return mysql_query($sql, $_sess_db);

}

?>

What question are you answering? And how does this improve/enhance on the 9 other answers?

Shakil Ahmmed · Accepted Answer · 2020-04-13 20:32:16Z

0

Use :

session_name("put_a_session_name");
session_start([
  "cookie_domain" => ".example.com",
  "cookie_path" => "/"
]);

answered Apr 13, 2020 at 20:32

Shakil Ahmmed

1287 bronze badges

Comments

Patrick Mevzek · Accepted Answer · 2019-08-02 22:18:22Z

-2

A quick and dirty solution is to use this for your redirect:

header( $url.'?'.session_name().'='.session_id() );

this will add something along the lines of ?PHPSESSID=etnm7kbuf5lg0r6tv7je6ehtn4 to the URL, which tells PHP the session id it should use.

edited Aug 2, 2019 at 22:18

Patrick Mevzek

12.9k17 gold badges46 silver badges62 bronze badges

answered Jun 30, 2009 at 18:58

sakabako

1,1507 silver badges15 bronze badges

4 Comments

dragonmantank Over a year ago

It also leaves it highly vulnerable to session theft :) The problem isn't with the session IDs not matching (they are, see my updated post), but with the data not moving between the domains.

Ian Jamieson Over a year ago

Agreed, this is highly vulnerable leaving session ID in the query string.

sakabako Over a year ago

Cookies are also sent as plain text, this does not open any avenues that were not already open. I'm not saying it's a good solution, but it is no less secure than using cookies.

Bastiaan ten Klooster Over a year ago

It is less secure in the sense that users may be (tricked into) sharing their URL and thus share their active session ID. It is much less likely that a user will share their session ID cookie unwittingly.

Collectives™ on Stack Overflow

PHP Sessions across sub domains

16 Answers 16

14 Comments

Comments

3 Comments

Comments

1 Comment

Comments

1 Comment

Comments

1 Comment

Comments

Comments

Comments

Comments

1 Comment

Comments

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

16 Answers 16

14 Comments

Comments

3 Comments

Comments

1 Comment

Comments

1 Comment

Comments

1 Comment

Comments

Comments

Comments

Comments

1 Comment

Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related