what is your key? you can paste the contents of config/session.php here so we can help you.
Main Topics
Browse All TopicsBecause of session problems in CodeIgniter (PHP) that were clogging up error logs, I followed a recommendation to set the cookie domain, which was previously unset. So this was changed from $config['cookie_domain'] = ''; to $config['cookie_domain'] = '.domainname.com'; With the leading . to cover all sub-domains.
Since this, anyone who visited the site was not able to do anything that required a session, so logging in etc. So I changed the setting back. However the problem still persists. I think that anyone who came to the site during the period of time that setting was active, have been given a cookie that won't let them login and it won't expire for another two weeks.
Is there anything I can do programatically to delete this cookie from those that required it deleted yet keep things the same for those who don't? It's hard to tell how many people may be affected and it seems I can't fix the problem without screwing it up for other users.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Thanks for the replies.
The cookie data is encrypted - so I can't show you the data.
@gokce_yalcin: Not sure what you're referring to by key. In my config.php file I have the following
$config['cookie_prefix'] = '';
$config['cookie_domain'] = '';
$config['cookie_path'] = '/';
Hopefully this will help. Maybe you can point me in the direction of the key (I have no session.php file)
Thanks
No, probably i got confused between Kohana and CI (they are pretty close, Kohana is a strict PHP5 fork of CI). seems it is generating the key random, whatever it is it should be destroyed by session_destroy(); , but CI might used additional cookies for domains.
You can take following steps:
1- get firefox
2- install firebug
3- install firecookie
4 -go to your site
5 -open firebug console, enable cookies
6- go to cookies section, note that cookies
7- redo "$config['cookie_domain'] = '.domainname.com';"
8- refresh the page, look additional cookies
9 - look changed cookies and new cookie names and note them.
10 - put 'setcookie ("notedcookie", "", time() - 3600);' to your global controller.
11 - restore your config
"What in the world does this mean?
"The cookie data is encrypted - so I can't show you the data."
A cookie is nothing more than a text file. You can use var_dump($_COOKIE)
Scripts may process cookies in a variety of ways, thus the cookie may control a lot of the user experience. Changing the algorithms that create and consume them is fraught with risk, as you have shown. If I were in this situation, I would try to (1) correct the cookie setting and testing routines and (2) change the name of the cookies. The upshot of that is that all your clients cookies would be lost - once - and they would have to go through the login and preference-setting process again, but it would leave you with things straightened out at last.
I like gokce_yalcin's suggestions above about how to visualize the cookies. Here is a script with some comments that will enable you to see how cookies work. You can install it and watch them in action.
HTH, ~Ray
@Ray_Paseur: he is probably talking about content encrypted cookies, its used for client-side malware softwares, or some valueable data you gave to client, but didnt want to read by client. CI encrypting cookie data that set by PHP as an option. You can do something like that also with using hardened PHP patchs. This way JS can not process the cookie, which means no XSS cookie manuplation except session-key fixations. If you open the file, all you will see is encrypted data (blowfished for example). you should decrypt to see the actual contents and to do that you would need the encryption key which its always kept at server side.
@hbkmunroe: You can get the cookie contents using CI cookies class. It should decrypt it on-the-fly.
@Ray_Paseur: The cookie data is encrypted so it basically looks like this 0q2xiL9EhzKJC3fOKHNyIZG4AS
But I don't think the content of the cookie is important
Basically what I would like to know is if it is possible to read a users cookie, determine if it has value for the domain set (it seems if one isn't set it defaults to a Host value) and if so, how to unset any cookies that match that.
Or if not, a valid method for unsetting cookies based purely on the value of the domain setting, not on the data.
@gokce_yalcin: Makes sense. I do not do that; instead I use a link back to a record in the data base that holds stateful information for the client. The thinking is that a lost cookie that might get decrypted could be more dangerous than a cookie that points to a row of the client-state table. The state-table has other protections that resist false cookies.
Regarding this: "...the content of the cookie is important" because it is all you can get back from the browser.
You can only set cookies for your own domain, subdomain and paths. A cookie for ray.com cannot work for ray.org, but a cookie for www.ray.com can work for .ray.com, IF it was set correctly so that it is applicable to both the domain and the www subdomain. You can have a cookie that works for sub.ray.com but not for www.ray.com, etc. Lots of combinations.
The domain of an existing cookie is not present in a way that you can get to it on the server, unless you put this information into the cookie. See below for a sample of the cookies on my browser at the moment. $_COOKIE is just an associative array. You put a lot of stuff into the setcookie() function, but that all goes to the client machine where it is under control of the browser.
More information on what you can find in a cookie is available here:
http://us.php.net/manual/e
More information on what it takes to set a cookie is available here (the path and domain have well-documented default values):
http://us.php.net/manual/e
HTH, ~Ray
@hbkmunroe, Limited Member: Please explain why you marked this answer down to a "B" without any discussion of what you thought was the deficient part of the answer? You are trying to do something that has been made (deliberately) architecturally impossible. "It don't work that way" is the REAL answer. We tried to give you advice for diagnostic purposes and workarounds, but you are up against a designed security wall when you try to get information that browsers and cookies are not supposed to give to the server. Just because you want to do something that is impossible - that does not make it appropriate to give poor grade.
If you would like to refer to the grading guidelines, they are available here:
http://www.experts-exchang
If you would like to ask a moderator to reopen the question so you can correct the grade, and give gokce_yalcin some credit for considerable contribution to the work here, you can use the "Request Attention" button at the lower right of the original post.
Thanks for your consideration, ~Ray
Business Accounts
Answer for Membership
by: Ray_PaseurPosted on 2009-06-08 at 08:33:18ID: 24573170
Can you please post a sample of the data in the good cookie and in the bad cookie? I can show you how to clear the bad ones. Best, ~Ray