JavaScript redirection problem with PHP sessions

Question

I set a session variable on login subdomain, and response json from another subdomain if the login was successful, the responsed json is checked by a script and the script does a location.href = "new url". On the redirected site "new url" I want to check my session variables if the user is logged in or not, but there are no session variables set. Does location.href = "" destroy my session? How to fix this problem? session.cookie_domain is set to '.mydomain.com'.

login.mydomain.com:

$.post('http://api.mydomain.com/index.php', {action: 'login', username: username, password: password}, function(response) {
            var success = $.parseJSON(response);
            if(success.success == 'true') {
                location.replace = 'http://my.mydomain.com';
            }
        });

api.mydomain.com:

session_start();
$_SESSION['active'] = true;
header('Access-Control-Allow-Origin: http://login.mydomain.com');
echo '{"success": "true"}';

my.mydomain.com:

session_start();
if(!isset($_SESSION['active']) && !$_SESSION['active']) {
    header("Location: http://login.mydomain.com");
    echo $_SESSION['access_token'].' test';
}
else {   
    echo 'Success!'; 
}

Use Firebug and/or HTTPFox in Firefox to view what's going back and forth in the headers. Usually a disappearing session is due to the session cookie being incorrect set, so you get a brand new empty session on the new page. — Marc B
– Marc B, Commented Aug 4, 2011 at 16:42

Isaac Chargoy Vivaldo · Accepted Answer · 2013-12-18 17:30:11Z

2

I had the same problem and I found when I use a relative url (location.ref="index.php"), all sessions variables exists. But when I use a absolute url (location.ref="http://mydomain.com/index.php") it kills all my session variables.

answered Dec 18, 2013 at 17:30

Isaac Chargoy Vivaldo

212 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Apolymoxic Over a year ago

This was exactly my problem... and then I would end up with multiple sessions and couldn't tell which one would be loaded. Thank you!

shanethehat · Accepted Answer · 2011-08-04 16:30:40Z

1

You don't seem to be calling session_start() in the second code block.

answered Aug 4, 2011 at 16:30

shanethehat

15.6k11 gold badges59 silver badges87 bronze badges

1 Comment

shanethehat Over a year ago

I see you are now. Fair enough, seemed a bit too easy.

Nimantha · Accepted Answer · 2021-11-06 08:21:07Z

0

From what you're saying you could have a couple of issues contributing to this problem.

PHP cookies are set by the server when the page is loaded, no page load means no cookie is set, if you're using pure JSON with no page load then you may not be able to set your session and return it to the browser.
Also remember that PHP sessions are effectively a cookie and the rules for cookies apply, so if you're setting a PHP session at api.mydomain.com and expect it to work at my.mydomain.com it probably wont work.

You can find a viable solution to handling login data and the sessions over multiple sub-domains here

edited Nov 6, 2021 at 8:21

Nimantha

6,5476 gold badges32 silver badges78 bronze badges

answered Aug 4, 2011 at 16:40

Ryan

1,8881 gold badge15 silver badges18 bronze badges

8 Comments

Pascal Bayer Over a year ago

I've checked what you said, but sessions are also set when you call a page via XMLHttpRequest, the problem is that each time I call the php file via XMLHttpRequest I get an other session_id, why is this so?

Ryan Over a year ago

Please elaborate on 'another session_id'? Do you mean that the session info is stored but the session_id being used is different to what you expect it to be? You said in your question "there are no session variables set"

Pascal Bayer Over a year ago

I've added following line to api.mydomain.com: echo session_id(); Each time api.mydomain.com is called I get another session_id returned.

Ryan Over a year ago

That would be because api.mydomain.com is creating a new session each time it is called from what you're saying, you may want to add a line like if(!isset($_SESSION['active'])) { $_SESSION['active'] = true;}, this should stop the script creating a new PHP session each time the script is called

Pascal Bayer Over a year ago

the api-call has a Response-Header: PHPSESSID=4acb4d659b963ab4a4ceb33ae362dc50; but the cookie is not set in the browser

|

Collectives™ on Stack Overflow

JavaScript redirection problem with PHP sessions

3 Answers 3

1 Comment

1 Comment

8 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

1 Comment

8 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related