PHP end of session problem

The session_start() function is on line 4. Like I said the script works locally.

Check the session directory. Make sure the web server has permissions to write to it.

And why did I not see that!

Can you add ...

<?php
error_reporting(-1);
ini_set('display_errors', 1);

to show ALL errors/warnings/notices.

Not sure what you mean by sessions directory, I am writing to a database rather than a file.

How do you test for errors with MySQLI?  Does it put something in $result?

You might want to add var_dump($_SESSION) to this script to see what you've got in there.  It looks like it could be a data dependent error.

Nope.

You are using file session data.

If $_SESSION is not set, then you call session_start().

Nothing wrong with that, but you do not also call session_set_save_handler to set up the DB access.

So, again, load ...

<?php
phpinfo();
?>

and check what the session entries are.

Check the directory for the sessions and make sure that location is accessible.

And check the error logs

Thanks, I have added var_dump($_SESSION) to the script as you suggested. However, it doesn't show anything on screen because the logout process goes straight back to the index page. Any suggestion as to how to check the dump?

Session information is being written to /var/lib/php/session and I the session file is recording something. For example, I logged in, allowed the auto logout to execute and then checked the session file which contains this:

MM_Username|s:2:"12";MM_UserGroup|s:15:"businessManager";userSessionID|s:40:"3b03ecbc93af45b268b105360164ae471648187f";session_start|i:1253725180;fileUploadStatus|b:0;

Not sure whether there's anything helpful in there.

One thing I didn't say is that if the user logs out using the logout link the sessionID does get deleted from the database, it just isn't happening when the auto logout redirects to the endSession page.

How is the auto-logout initiated?

How does it redirect to the index page? I don't see the code for that?

I am using a script made available by Phil Palmieri (http://philpalmieri.com/2009/09/jquery-session-auto-timeout-with-prompt/) which has a redirect in it if you need to manage closing out session variables etc. You can see the script by following the url shown.

I wonder if you could add the following to the code ...

<?php
file_put_contents('./logout.log', date('r : ') . var_export($_COOKIE, True) . PHP_EOL, FILE_APPEND);


to the logout script.

I suspect the session ID isn't coming into the script.

No session id = no session

No session = no session user

etc.

Can you show the JS code you are using which is setting the logout_url?

In looking at the code ...

    var redirect = function()
    {
      if(opts.logout_url)
      {
        $.get(opts.logout_url);
      }
      window.location.href = opts.redirect_url;
    }


I'm a little worried about the timing.

So, an additional debug could be useful...


<?php
file_put_contents('./logout.log', 'Start LOGOUT : ' . date('r : ') . var_export($_COOKIE, True) . PHP_EOL, FILE_APPEND);

// Your logout code.

file_put_contents('./logout.log', 'End  LOGOUT : ' . date('r : ') . var_export($_COOKIE, True) . PHP_EOL, FILE_APPEND);
exit;
?>


But I'd also add something similar to the main redirected page.

<?php
file_put_contents('./logout.log', 'Start REDIRECT : ' . date('r : ') . var_export($_COOKIE, True) . PHP_EOL, FILE_APPEND);

// Your logout code.

file_put_contents('./logout.log', 'End  REDIRECT : ' . date('r : ') . var_export($_COOKIE, True) . PHP_EOL, FILE_APPEND);
?>

The full JS code from the timedLogout.js file is below (copyright of Phil Palmieri). I have added the additional debug to the logout_url file (endSession.php) but cannot find the logout file on my system! However, I am not generating sessions using a cookie, why is $_COOKIE in there? Regarding the code for the main redirected page I am not sure where to put that because there is no auto-logout code on any page apart from endSession.php.

// JavaScript Document
(function($){
 $.fn.timedLogout = function(options) {
    var defaults = {
			inactivity: 30000, // 15 Minutes
			noconfirm: 10000, // 10 seconds
			sessionAlive: 10000, // 5 minutes
			redirect_url: 'http://localhost/~kcalder/RED/index.php',
			click_reset: true,
			alive_url: 'http://localhost/~kcalder/RED/menu.php',
			logout_url: 'http://localhost/~kcalder/RED/endSession.php'
		}
    
    //##############################
    //## Private Variables
    //##############################
    var opts = $.extend(defaults, options);
    var liveTimeout, confTimeout, sessionTimeout;
    var modal = "<div id='modal_pop'><p>You are about to be automatically logged out due to inactivity on the PMS.</p></div>";
    //##############################
    //## Private Functions
    //##############################
    var start_liveTimeout = function()
    {
      clearTimeout(liveTimeout);
      clearTimeout(confTimeout);
      liveTimeout = setTimeout(logout, opts.inactivity);
      
      if(opts.sessionAlive)
      {
        clearTimeout(sessionTimeout);
        sessionTimeout = setTimeout(keep_session, opts.sessionAlive);
      }
    }
    
    var logout = function()
    {
      
      confTimeout = setTimeout(redirect, opts.noconfirm);
      $(modal).dialog({
        buttons: {"Click to stay logged in":  function(){
          $(this).dialog('close');
          stay_logged_in();
        }},
        modal: true,
        title: 'Auto Logout'
      });
      
    }
    
    var redirect = function()
    {
      if(opts.logout_url)
      {
        $.get(opts.logout_url);
      }
      window.location.href = opts.redirect_url;
    }
    
    var stay_logged_in = function(el)
    {
      start_liveTimeout();
      if(opts.alive_url)
      {
        $.get(opts.alive_url);
      }
    }
    
    var keep_session = function()
    {
      $.get(opts.alive_url);
      clearTimeout(sessionTimeout);
      sessionTimeout = setTimeout(keep_session, opts.sessionAlive);
    } 
    
    //###############################
    //Build & Return the instance of the item as a plugin
    // This is basically your construct.
    //###############################
    return this.each(function() {
      obj = $(this);
      start_liveTimeout();
      if(opts.click_reset)
      {
        $(document).bind('click', start_liveTimeout);
      }
      if(opts.sessionAlive)
      {
        keep_session();
      }
    });
    
 };
})(jQuery);
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:

So, if you are not using session cookies, you need to be getting the session id via the URL.

So, the logout_url needs to contain the session id.


But, from the code you've supplied so far, you _are_ using session cookies. Hence $_COOKIE being present.



I'm wondering if there is a gap in your understanding of how sessions are maintained.

Every request that a browser makes to a server is completely disconnected to every other request. This is by design and you cannot alter that.

This is known as "stateless".

HTTP is a stateless protocol.

Nothing exists before or after the request which the request can expect or rely on.


To get around this, the idea of a session exists.

The issue is how do you get these disconnected requests associated with the session.

The answer, in most cases, is a session cookie.

PHP's session cookie is, by default, PHPSESSID.

Run the attached script twice.

The first time the output will be an empty array. This is expected because the cookies coming into the script will not have the session (oh. thinking about this, you MAY actually have a value there - so if you can close your browser first, that will remove any session cookies for the domain).

The second time you run the script you will have output.

The session id is maintained as a cookie - this is transparent to you normally. You _CAN_ alter it, but you have to do more work.



What I am trying to determine is if using JS location.href and / or $.get(), supply the cookie.

If not, you can't connect to the server side session and no username/id and no delete in the DB.


If you can check your cookies in your browser first. If you have any for the local domain, deleting them will be useful to prove what I am talking about.

<?php
session_start();
var_dump($_COOKIE);
                                              

1:
2:
3:

Thanks, I am just getting to grips with sessions. I understand what you are driving at. I am using cookies rather than the url extension to manage sessions. However, I don't think the JS file has anything to do with the session variables, my file endSession.php handles the session closure (or should), so once the JS file sets the redirect to endSession.php all that file does is delete the session from the session table which then allows the user to login again if required. If the session id is not deleted from the database then the user is not permitted to login as I have set up a routine to ensure that any given user can only have a single session open.

For the endSession.php script, how does it know which session to delete?

You'll probably say $_SESSION['MM_Username']

And I'll say No.

That's a value held in the session. Not the session itself.

The JS file _MUST_ supply a cookie to allow PHP to extract the session_id, so that the correct $_SESSION is setup so you can get the MM_Username value.

So. I need you to debug the endSession.php script.

So that is why I've asked you to log the cookies it receives. That's where the session id is.

If the cookie is empty, then the JS call is NOT supplying the cookie.

Without that, you can't continue.

Really. Honestly. 20 years as a s/w developer and a PHP ZCE say so!

Really really really.

Regards.

Richard.

P.S. You're lucky to get a response. The laptop is in the kitchen. I'm cooking chicken curries. I've got a bottle of wine or two open and Billy Bragg on nice and loud!

Good times!

Right, I see now - how does endSession.php know which session to delete. Good question and one that I have clearly overlooked! Enjoy your chicken curry, wine and Billy Bragg. I'll get to debugging endSession.php and post the results.

Thanks!

It went well.

I hope your debugging did.

I will get around to it later today. What I don't understand though is how the auto-logout routine works fine on my local machine but not on the remote server; the code is exactly the same, the only thing that changes are the database connection parameters.

Most likely it is a timing issue.

On index.php and menu.php, what do you do with the session data?

As AJAX calls are asynchronous, the GET (for the logout) happens at the same time as either the index.php or menu.php.

So, if these ALSO write to the current session (the one supplied in that request's cookie), you may end up simply writing a brand new entry.

On the table, do you have an IDENTITY/AUTOINC column?

If not add one.

Let's see if the session entry in the DB is being deleted and recreated.

I have posted the full login script below. I generate a sha1 hashed session variable called userSessionID from their username (obtained from the login query) and check the database to determine whether it is already in there (no index or auto-increment for the table). If the user is already in the database then they are already logged in somewhere else and the session is destroyed (although the redirect to concurrentLogin.php doesn't seem to work). If the userSessionID is not found in the database then it is generated, inserted and the login continues to menu.php.

Once the user is at menu.php if they do nothing for the period set in the autoLogout.js script they get logged out using endSession.php which should simply delete the variable userSessionID from the database thus enabling them to login afresh.

<?php
// *** Validate request to login to this site.
if (!isset($_SESSION)) {
  session_start();
}
 
$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck'])) 
{
	$_SESSION['PrevUrl'] = $_GET['accesscheck'];
}
 
if (isset($_POST['usr'])) 
{
  $loginUsername=$_POST['usr'];
  $password=sha1($_POST['pwd']);
  $MM_fldUserAuthorization = "userLevel";
  $MM_redirectLoginSuccess = "menu.php";
  $MM_redirectLoginFailed = "failure.php";
  $MM_redirecttoReferrer = false;
  mysql_select_db($database_RED_links, $RED_links);
  	
  $LoginRS__query=sprintf("SELECT user_pk, userName, password, userLevel FROM `user` WHERE user_pk=%s AND password=%s",
  GetSQLValueString($loginUsername, "int"), GetSQLValueString($password, "text")); 
   
  $LoginRS = mysql_query($LoginRS__query, $RED_links) or die(mysql_error());
  $loginFoundUser = mysql_num_rows($LoginRS);
  if ($loginFoundUser) 
  {
    $loginStrGroup  = mysql_result($LoginRS,0,'userLevel');
    
    //declare session variables and assign them
    $_SESSION['MM_Username'] = $loginUsername;
    $_SESSION['MM_UserGroup'] = $loginStrGroup;
	$_SESSION['userSessionID'] = sha1(mysql_result($LoginRS,0,'userName'));
	
	// Used in timeout.php
	$_SESSION['session_start'] = time();
	
	// Set flag for file upload success/failure
	$_SESSION['fileUploadStatus'] = false;
	
	// *** Check the login details against current sessions to prevent multiple logins *** //
	// Connect to the database
	@ $db = new mysqli('localhost', 'kcalder', 'pw', 'db');
	// LOCAL...@ $db = new mysqli('localhost', 'root', 'pw', 'db');
	if (!$db) die ('Could not connect to the database: '.mysql_error());
	
	// Details of this login
	$user = $_SESSION['MM_Username'];
	$session = $_SESSION['userSessionID'];
 
	// Query the database
	$loginStatus = 0;
	$entries = 0;
	$query = "SELECT * FROM session";
	$result = $db->query($query);
	$num_results = $result->num_rows;
	for ($i = 0; $i < $num_results; $i++)
	{
		$row = $result->fetch_assoc();
		// If the user is in the session table check the entry
		if ($row['sessionUser'] == $user)
		{
			// There is an entry
			$entries++;
			// Check the session ID
			if (!strcmp($row['sessionID'], $session))
			{
				$loginStatus = 1;
			}
		}
	}
	
	// If loginstatus = 1 then user is already logged in and session needs to be destroyed
	if ($loginStatus == 1)
	{	
		unset($_SESSION['MM_Username']);
		unset($_SESSION['MM_UserGroup']);
		unset($_SESSION['userSessionID']);
		session_destroy();
		header("Location: concurrentLogin.php");
	}
	
	// If there are no entries insert the session details
	if ($entries == 0)
	{
		$query = "INSERT INTO session (sessionID, sessionUser) VALUES ('$session', '$user')";
		$result = $db->query($query);
	}
	
    if (isset($_SESSION['PrevUrl']) && false) 
	{
      $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];	
    }
    header("Location: " . $MM_redirectLoginSuccess );
  }
  else 
  {
    header("Location: ". $MM_redirectLoginFailed );
  }
}
?>

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:

We need to start tracking what is happening.

Obviously, the scripts are not working as expected, so some debugging is required.

The following line should help ...

@file_put_contents('./debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);

I would put this line in several key places in the scripts to log what is happening.

The log file may grow very quickly.

The name (./debug.log) should be converted to an absolute filename so that if the scripts are in different folders, the same log file is written to.

So, a script like ...

<?php
// *** Validate request to login to this site.
if (!isset($_SESSION)) {
  session_start();
}
 
$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck']))
{
        $_SESSION['PrevUrl'] = $_GET['accesscheck'];
}
 
if (isset($_POST['usr']))
{


should become something like ...

Your log file will contain a line for each debug. This will allow you to see what is going on across multiple scripts.

You will need to make sure that the web server account has write access to the file.

<?php
					@file_put_contents('./debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
// *** Validate request to login to this site.
if (!isset($_SESSION)) {
					@file_put_contents('./debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
  session_start();
					@file_put_contents('./debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
}
					@file_put_contents('./debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
 
$loginFormAction = $_SERVER['PHP_SELF'];
					@file_put_contents('./debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
if (isset($_GET['accesscheck'])) 
{
					@file_put_contents('./debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
        $_SESSION['PrevUrl'] = $_GET['accesscheck'];
					@file_put_contents('./debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
}
					@file_put_contents('./debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
 
if (isset($_POST['usr'])) 
{
					@file_put_contents('./debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
  
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:

I'm really stuck with ...

      if(opts.logout_url)
      {
        $.get(opts.logout_url);
      }

This is saying to me ...

If there is a property of opts which does not evaluate as false, then ...

I can't see what $.get() does.

$ is jQuery - fair enough.

get() though is the CSS collector.

get( )      Returns: Array<Element>
Access all matched DOM elements.

get( index )      Returns: Element
Access a single matched DOM element at a specified index in the matched set.

Nothing to do with launching an HTTP GET request.

As I see it anyway.

Either way. Add the debugging.

You have to prove that the code works remotely by presenting a debug log file showing the calls are getting made.

I'm not convinced.

OOI, run the same debugged code locally. See what you get.

Do you have a live version I can see? I want to see what requests are actually generated? (Firefox with Firebug and Wireshark).

I have put the debugging lines interspersed between all of the code that is involved in the auto logout procedure, and I have put them into the menu.php file as that's the page that the user is taken to when they first login. However, it seems that the file isn't getting written to the disk either locally or on the host server. I have set a full url path to the root of the site so I know that the folder has read/write access.

As the site I am working on is my company's intranet we'd have to go offline with this and I could set you up a temporary account so that you can see what's happening.

Getting the debug working is pretty important.

Try this ...

<?php
error_reporting(-1);
ini_set('display_errors', 1);
echo 'Current dir:', getcwd(), ' and we wrote ', file_put_contents('./log.log', 'The time is : ' . date('r') . PHP_EOL, FILE_APPEND), ' bytes.', PHP_EOL;
?>

Wherever you place this file you should be getting a log.log file when you run it.

Try it locally.

OK then, this is what I get when I run the file...

Current dir:/Users/kcalder/Sites/RED and we wrote Warning: date(): It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/London' for 'BST/1.0/DST' instead in /Users/kcalder/Sites/RED/log.php on line 4 Warning: file_put_contents(./log.log): failed to open stream: Permission denied in /Users/kcalder/Sites/RED/log.php on line 4 bytes.

Right.

2 problems.

The date.timezone issue is important as you may find all sorts of issues with cookie expiry times when dst changeover happens.

The important one is the permission denied.

I would recommend creating a folder with write permissions somewhere.

Then put the absolute path in the script...

file_put_contents('/some/path/with/write/permissions/log.log', ....

OK, ignoring the time/date issue and concentrating on the main issue, I have created the folder and set write permissions for all. I changed the debug script to include the path to debug.log and included the debug script as below. With the auto logout routine working on my local machine (i.e., the userSessionID entry is deleted) the following is what's written to the debug.log file...

1,254,399,934.8552100658 /Users/kcalder/Sites/RED/menu.php:14:r6bjakk1ocb5u8bu4dnt8oedm1

which quite frankly means diddly to me.

<?php require_once('connections/RED_links.php'); 
@file_put_contents('http://localhost/~kcalder/RED/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
?>
<?php
//initialize the session
if (!isset($_SESSION)) 
{
	@file_put_contents('http://localhost/~kcalder/RED/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
	session_start();
}
// ** Logout the current user. **
$logoutAction = $_SERVER['PHP_SELF']."?doLogout=true";
@file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
if ((isset($_SERVER['QUERY_STRING'])) && ($_SERVER['QUERY_STRING'] != ""))
{
  @file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
  $logoutAction .="&". htmlentities($_SERVER['QUERY_STRING']);
}
if ((isset($_GET['doLogout'])) &&($_GET['doLogout']=="true"))
{
  @file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
  // Delete the session entry in the database
  @ $db = new mysqli('localhost', 'root', 'pw', 'db');
  @file_put_contents('/Users/kcalder/Sites/RED/log/debug.logg', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
 
  if (!$db) die ('Could not connect to the database: '.mysql_error());
 @file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
 
 $query = sprintf("DELETE FROM session WHERE sessionUser=%d", $_SESSION['MM_Username']);
 @file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
 
 $result = $db->query($query);
@file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
  
  //to fully log out a visitor we need to clear the session variables
  unset($_SESSION['MM_Username']);
  @file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
  unset($_SESSION['MM_UserGroup']);
  @file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
  unset($_SESSION['userSessionID']);
  @file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
  session_destroy();
  @file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
  
  $logoutGoTo = "index.php";
  if ($logoutGoTo) 
  {
    header("Location: $logoutGoTo");
    exit;
  }
}

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:

I am beginning to think that this might be a timing issue, the auto logout routine appears to work intermittently on my local machine, just not at all on the remote server.

Can you change ...

@file_put_contents('http://localhost/~kcalder/RED/debug.log',

to

@file_put_contents('/Users/kcalder/Sites/RED/log/debug.log',

please.

The log file should show you a LOT more detail.

1,254,399,934.8552100658 /Users/kcalder/Sites/RED/menu.php:14:r6bjakk1ocb5u8bu4dnt8oedm1

is broken down into ...

The time the debug line was generated : 1,254,399,934.8552100658
The fullname of the script writing the debug : /Users/kcalder/Sites/RED/menu.php
The line number in the file : 14
The session ID as provided by the $_COOKIE['PHPSESSID'] : r6bjakk1ocb5u8bu4dnt8oedm1

So, this log file will show you which lines of code (more or less) are being executed when the auto logout process kicks in.

Once we have that, I can explain what is happening.

Yes, sorry I noticed the two lines with the wrong path in only once I had posted the code. I deleted the existing log file, logged in again and allowed the auto logout to fire. Here's the contents of the debug.log file now with the paths corrected...

1,254,403,303.2875320911 /Users/kcalder/Sites/RED/menu.php:2:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,403,303.2877700329 /Users/kcalder/Sites/RED/menu.php:8:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,403,303.2883310318 /Users/kcalder/Sites/RED/menu.php:13:r6bjakk1ocb5u8bu4dnt8oedm1

And you've got the same file_put_contents line throughout the code dealing with the autologout?

Er...coming right up!

Presumably you mean interspersed in endSession.php not timedLogout.js?

Well, this is what has been generated in the log file through two successive logins and auto logouts. The first 3 lines were generated after I was logged out automatically and the redirect failed to go to endSession.php. I can tell this because userSessionID is still in the database table and wasn't deleted meaning I had to remove it manually before trying to login again. The remaining lines were generated after a second login/auto-logout at which time the redirect to endSession.php worked.

1,254,410,155.1620330811 /Users/kcalder/Sites/RED/menu.php:2:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,155.1623771191 /Users/kcalder/Sites/RED/menu.php:8:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,155.1631588936 /Users/kcalder/Sites/RED/menu.php:13:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,215.9074170589 /Users/kcalder/Sites/RED/menu.php:2:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,215.9076359272 /Users/kcalder/Sites/RED/menu.php:8:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,215.9079999924 /Users/kcalder/Sites/RED/menu.php:13:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,240.7787539959 /Users/kcalder/Sites/RED/menu.php:2:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,240.7790300846 /Users/kcalder/Sites/RED/menu.php:8:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,240.7791829109 /Users/kcalder/Sites/RED/menu.php:13:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,280.9987630844 /Users/kcalder/Sites/RED/endSession.php:6:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,280.9992530346 /Users/kcalder/Sites/RED/endSession.php:12:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,280.9993760586 /Users/kcalder/Sites/RED/endSession.php:14:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,281.0017800331 /Users/kcalder/Sites/RED/endSession.php:20:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,281.0019109249 /Users/kcalder/Sites/RED/endSession.php:27:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,281.0019850731 /Users/kcalder/Sites/RED/endSession.php:29:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,281.0026540756 /Users/kcalder/Sites/RED/endSession.php:31:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,281.0027580261 /Users/kcalder/Sites/RED/endSession.php:36:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,281.0028278828 /Users/kcalder/Sites/RED/endSession.php:38:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,281.0028960705 /Users/kcalder/Sites/RED/endSession.php:40:r6bjakk1ocb5u8bu4dnt8oedm1
1,254,410,281.0032999516 /Users/kcalder/Sites/RED/endSession.php:42:r6bjakk1ocb5u8bu4dnt8oedm1

Can you show your current endSession.php script please?

We can see the script is called WITH a valid session id. Now time to add some debugging with regard the DB DELETE.

Can you add the @file_put_content() line to any script that deals with the session/db stuff.

Trying to see the flow of things.

I'm wondering what happens after endSession is called.


With regard to ...


 $query = sprintf("DELETE FROM session WHERE sessionUser=%d", $_SESSION['MM_Username']);
 @file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
 

Is MM_Username a number cause that is what you are casting it as in the sprintf function.

Change the debug line here to ...

 @file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . ':' . $query . PHP_EOL, FILE_APPEND);

The full endSession script is as in the snippet below. The outcome of running the debug on it with the adjusted debug line is as follows...

1,254,494,221.2450859547 /Users/kcalder/Sites/RED/menu.php:2:c270d9u5668ffffm6jl7lb64v0
1,254,494,221.2454929352 /Users/kcalder/Sites/RED/menu.php:8:c270d9u5668ffffm6jl7lb64v0
1,254,494,221.2487909794 /Users/kcalder/Sites/RED/menu.php:13:c270d9u5668ffffm6jl7lb64v0
1,254,494,261.4845840931 /Users/kcalder/Sites/RED/endSession.php:6:c270d9u5668ffffm6jl7lb64v0
1,254,494,261.4848310947 /Users/kcalder/Sites/RED/endSession.php:12:c270d9u5668ffffm6jl7lb64v0
1,254,494,261.4853150845 /Users/kcalder/Sites/RED/endSession.php:14:c270d9u5668ffffm6jl7lb64v0
1,254,494,261.4871919155 /Users/kcalder/Sites/RED/endSession.php:20:c270d9u5668ffffm6jl7lb64v0
1,254,494,261.4872961044 /Users/kcalder/Sites/RED/endSession.php:27:c270d9u5668ffffm6jl7lb64v0
1,254,494,261.4877259731 /Users/kcalder/Sites/RED/endSession.php:29:c270d9u5668ffffm6jl7lb64v0
1,254,494,261.4892289639 /Users/kcalder/Sites/RED/endSession.php:31:c270d9u5668ffffm6jl7lb64v0
1,254,494,261.4893510342 /Users/kcalder/Sites/RED/endSession.php:36:c270d9u5668ffffm6jl7lb64v0
1,254,494,261.4902369976 /Users/kcalder/Sites/RED/endSession.php:38:c270d9u5668ffffm6jl7lb64v0
1,254,494,261.4907789230 /Users/kcalder/Sites/RED/endSession.php:40:c270d9u5668ffffm6jl7lb64v0
1,254,494,261.4914829731 /Users/kcalder/Sites/RED/endSession.php:42:c270d9u5668ffffm6jl7lb64v0
 
The above was logged when the auto logout DID delete the user session information. However, I tried this once before this when it didn't delete the session informatin but the debug included the query command was output to the log. Very odd.

Sorry, let's try that again. I had amended the debug in the wrong file. Putting the query string into the debug within endSession.php gives me...

1,254,495,234.8202230930 /Users/kcalder/Sites/RED/menu.php:2:c270d9u5668ffffm6jl7lb64v0
1,254,495,234.8204860687 /Users/kcalder/Sites/RED/menu.php:8:c270d9u5668ffffm6jl7lb64v0
1,254,495,234.8212630749 /Users/kcalder/Sites/RED/menu.php:13:c270d9u5668ffffm6jl7lb64v0
1,254,495,250.2579410076 /Users/kcalder/Sites/RED/menu.php:2:c270d9u5668ffffm6jl7lb64v0
1,254,495,250.2581501007 /Users/kcalder/Sites/RED/menu.php:8:c270d9u5668ffffm6jl7lb64v0
1,254,495,250.2607250214 /Users/kcalder/Sites/RED/menu.php:13:c270d9u5668ffffm6jl7lb64v0
1,254,495,290.4283299446 /Users/kcalder/Sites/RED/endSession.php:6:c270d9u5668ffffm6jl7lb64v0
1,254,495,290.4285249710 /Users/kcalder/Sites/RED/endSession.php:12:c270d9u5668ffffm6jl7lb64v0
1,254,495,290.4292490482 /Users/kcalder/Sites/RED/endSession.php:14:c270d9u5668ffffm6jl7lb64v0
1,254,495,290.4974210262 /Users/kcalder/Sites/RED/endSession.php:20:c270d9u5668ffffm6jl7lb64v0
1,254,495,290.4975779057 /Users/kcalder/Sites/RED/endSession.php:27:c270d9u5668ffffm6jl7lb64v0
1,254,495,290.4979400635 /Users/kcalder/Sites/RED/endSession.php:29:c270d9u5668ffffm6jl7lb64v0:DELETE FROM session WHERE sessionUser='13'
1,254,495,290.4992020130 /Users/kcalder/Sites/RED/endSession.php:31:c270d9u5668ffffm6jl7lb64v0
1,254,495,290.4993069172 /Users/kcalder/Sites/RED/endSession.php:36:c270d9u5668ffffm6jl7lb64v0
1,254,495,290.4998168945 /Users/kcalder/Sites/RED/endSession.php:38:c270d9u5668ffffm6jl7lb64v0
1,254,495,290.5003309250 /Users/kcalder/Sites/RED/endSession.php:40:c270d9u5668ffffm6jl7lb64v0
1,254,495,290.5010468960 /Users/kcalder/Sites/RED/endSession.php:42:c270d9u5668ffffm6jl7lb64v0
 
Full endSession.php script in snippet below...

<?php 
// Force logout based on timeout setting
 
if (!isset($_SESSION)) 
{
	@file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
	session_start();
}
 
// Report all errors
error_reporting(-1);
@file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
ini_set('display_errors', 1);
@file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
 
 
// Delete the session entry in the database
@ $db = new mysqli('localhost', 'root', 'pw', 'db');
@file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
if (!$db) 
{
	die ('Could not connect to the database: '.mysql_error());
	@file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
}
$user = $_SESSION['MM_Username'];
@file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
$query = "DELETE FROM session WHERE sessionUser='$user'";
@file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . ':' . $query . PHP_EOL, FILE_APPEND);
$result = $db->query($query);
@file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
 
 
//to fully log out a visitor we need to clear the session variables
unset($_SESSION['MM_Username']);
@file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
unset($_SESSION['MM_UserGroup']);
@file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
unset($_SESSION['userSessionID']);
@file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
session_destroy();
@file_put_contents('/Users/kcalder/Sites/RED/log/debug.log', number_format(microtime(True), 10) . ' ' . __FILE__ . ':' . __LINE__ . ':' . $_COOKIE['PHPSESSID'] . PHP_EOL, FILE_APPEND);
 
exit;
?>

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:

And is sessionUser 13 valid?

User_NAME_ ? Are you called "13"?

UseID would be fine and then I'd expect the query to use a number, not a string.

Add another column to the table. The column needs to be an autoinc/identity column. No need to change your code as the db will look after it.


There must be more code dealing with adding the session and logging the entry in the DB. Can you add the file_put_contents() line to that file please?



Either way, what it comes down to is the auto logout js script is wrong.

It shouldn't be calling 2 requests.

It should only call 1.

The endSession.php script should be doing the redirect.

Er, MM_Username is actually a reference to the primary key of the user rather than a string, I need to change it to userID or something. Can you spell out for me what an autoinc column will do? The initial login is managed on the index page so I have added the debug logging to that and the results are below (not for the auto logout); not sure what it tells us.

But it's certainly a problem if the js script is wrong since the whole shooting match is based on it (and I didn't write it), and it contains a specific line for the redirect since it doesn't manage the session.

1,254,513,956.6509370804 /Users/kcalder/Sites/RED/index.php:38:ufckeq28i5v71imnn9qc21bcq0
1,254,513,965.9895958900 /Users/kcalder/Sites/RED/index.php:38:ufckeq28i5v71imnn9qc21bcq0
1,254,513,965.9898269176 /Users/kcalder/Sites/RED/index.php:51:ufckeq28i5v71imnn9qc21bcq0
1,254,513,965.9905819893 /Users/kcalder/Sites/RED/index.php:53:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0368568897 /Users/kcalder/Sites/RED/index.php:55:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0380160809 /Users/kcalder/Sites/RED/index.php:57:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0385909081 /Users/kcalder/Sites/RED/index.php:59:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0390551090 /Users/kcalder/Sites/RED/index.php:61:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0401389599 /Users/kcalder/Sites/RED/index.php:63:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0403740406 /Users/kcalder/Sites/RED/index.php:67:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0442609787 /Users/kcalder/Sites/RED/index.php:70:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0444281101 /Users/kcalder/Sites/RED/index.php:72:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0450160503 /Users/kcalder/Sites/RED/index.php:76:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0455410480 /Users/kcalder/Sites/RED/index.php:80:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0460689068 /Users/kcalder/Sites/RED/index.php:82:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0466320515 /Users/kcalder/Sites/RED/index.php:84:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0472300053 /Users/kcalder/Sites/RED/index.php:88:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0477559566 /Users/kcalder/Sites/RED/index.php:92:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0498719215 /Users/kcalder/Sites/RED/index.php:102:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0499949455 /Users/kcalder/Sites/RED/index.php:104:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0505158901 /Users/kcalder/Sites/RED/index.php:108:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0510690212 /Users/kcalder/Sites/RED/index.php:110:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0516428947 /Users/kcalder/Sites/RED/index.php:112:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0864300728 /Users/kcalder/Sites/RED/index.php:114:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0865991116 /Users/kcalder/Sites/RED/index.php:116:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0873539448 /Users/kcalder/Sites/RED/index.php:155:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0902509689 /Users/kcalder/Sites/RED/index.php:157:ufckeq28i5v71imnn9qc21bcq0
1,254,513,966.0904181004 /Users/kcalder/Sites/RED/index.php:166:ufckeq28i5v71imnn9qc21bcq0
1,254,513,970.8644230366 /Users/kcalder/Sites/RED/index.php:38:ufckeq28i5v71imnn9qc21bcq0
 

I've not abandoned you. Been busy. Will try and get something for you to look at later this evening (about 8-9 hours time).

No problem, I appreciate you making time to help me.

Hi, just wondering if you are able to press on with this?

Hi and thanks for getting back on this again. I have a live site but since it is a commercial intranet I'll need to set you up as a user and give you a login. This information would need to be forwarded to you outside of EE, so let me know how you would like me to do that. Meanwhile, I'll sort out the files I have been logging (index.php, menu.php, endSession.php) as indicated.

You can email me at RQuadling at this site's domain.

Thanks, you should now have received an email from me with login details.

Richard, have you been able to login?

Again, please accept my apologies. My time on EE is purely voluntary.

Richard, I do understand. Does this mean that you are unable to continue?

No. Just busy.

I've "Requested assistance" as I think a fresh mind may give you the answer I'm trying to get to.

I can show you how to perform a standard logout operation, eliminating the session and the session data.  If you follow this logic and it still does not work, I think you might want to hire a developer to have a look at it.  Best regards, ~Ray

<?php // RAY_logout.php
// TEACHES HOW TO ELIMINATE A PHP SESSION
error_reporting(E_ALL);
 
// DEFINITIONS
define('COOKIE_LIFE', 60*60*24); // A 24-HOUR DAY IN SECONDS ( = 86,400 )
$cookie_expires	= time() - date('Z') - COOKIE_LIFE;
 
 
// ALWAYS START THE SESSION ON EVERY PAGE
session_start();
 
// CLEAR THE INFORMATION FROM THE $_SESSION ARRAY
$_SESSION = array();
 
// IF THE SESSION IS KEPT IN COOKIE, FORCE SESSION COOKIE TO EXPIRE
if (isset($_COOKIE[session_name()]))
{
   setcookie(session_name(), '', $cookie_expires, '/');
}
 
// TELL PHP TO ELIMINATE THE SESSION
session_destroy();
 
 
 
 
 
 
// OPTIONAL - CLEAR ALL COOKIES
/*
foreach ($_COOKIE as $key => $value)
{
   setcookie($key, '', $cookie_expires, '/');
}
*/
 
// OPTIONAL - TELL CLIENT ABOUT THE LOGOUT
/*
echo "YOU ARE LOGGED OUT";
*/
 
// OPTIONAL - REDIRECT TO THE HOME PAGE
/*
header("Location: /");
exit;
*/
?>

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48: