PHP session shared with subdomain

Question

I have read many forums (including this one) about passing session variables between subdomains, and I can't get this to work. Can someone explain what I am missing?

Step 1

In the php.ini file:

session.cookie_domain = ".mydomain.example"

Verified with phpinfo() that I am using the right php.ini file

Step 2

In page at www.mydomain.example set a session variable $_SESSION['a'], verify that it appears by calling it on the next page (it does). Click link to sub.mydomain.example.

Step 3

Page at sub.mydomain.example checks if session variable is set using:

$a = $_SESSION['a'];
if(!isset($_SESSION['a'])){
    echo "Error: Session Variable not available";
}

Unfortunately I am getting my error message. What am I missing?

Have you verified that phpinfo() when run on the subdomain also shows the correct cookie_domain setting? — webbiedave
– webbiedave, Commented May 14, 2010 at 15:55

boksiora · Accepted Answer · 2013-07-14 09:21:06Z

4

You must pass the session id as a cookie and set the same session id on the new domain

For example you can use this code

ini_set('session.cookie_domain', '.example.com');
$currentCookieParams = session_get_cookie_params();

$rootDomain = '.example.com';
session_set_cookie_params( 
    $currentCookieParams["lifetime"], 
    $currentCookieParams["path"], 
    $rootDomain, 
    $currentCookieParams["secure"], 
    $currentCookieParams["httponly"] 
); 

if(!empty($_SESSION)){
    $cookieName = session_id();
    setcookie('PHPSESSID', $cookieName, time() + 3600, '/', $rootDomain); 

}

if(isset($_COOKIE['PHPSESSID'])){
    session_name($_COOKIE['PHPSESSID']); 
}

answered Jul 14, 2013 at 9:21

boksiora

1,20815 silver badges17 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Your Common Sense · Accepted Answer · 2010-05-14 16:14:45Z

3

debugging.
is the thing you're missing.

first of all you have to watch HTTP headers to see what is going on and what cookies actually being set. You can use LiveHTTPHeaders Firefox addon or something. With such info you can find the problem. Without it noone can answer tour question "my sessions don't work"

It can prove your statement of proper domain setting in the session settings. Or disprove it.
It can reveal some other misconfiguring.
It may show you cookie being sent back by the browser - so you can be sure that is server side problem

To see the actual result of your code (instead of guessing based on the indirect consequences) always helps.

edited May 14, 2010 at 16:14

answered May 14, 2010 at 15:57

Your Common Sense

158k42 gold badges226 silver badges374 bronze badges

1 Comment

Ian Over a year ago

Thanks, I did load the LiveHTTPHeaders and I see this entry under the POST... Cookie: PHPSESSID 870bfb...etc So it is passing the sessionid to the next page, correct? I used a different method below and it works. I am not sure what to look for in the header for my other solution.

Patrick Mevzek · Accepted Answer · 2019-08-02 22:09:28Z

3

So, I went a different direction and used this entry which worked...

session_set_cookie_params(0, '/', '.mydomain.example');
session_start();

edited Aug 2, 2019 at 22:09

Patrick Mevzek

12.9k17 gold badges46 silver badges62 bronze badges

answered May 14, 2010 at 16:09

Ian

411 silver badge4 bronze badges

Collectives™ on Stack Overflow

PHP session shared with subdomain

Step 1

Step 2

Step 3

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

Step 1

Step 2

Step 3

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related