dbinteractive
asked on
Problem with session data across subdomains and protocols
Ready for this one, everyone?
I'm having a problem accessing a PHP session across subdomains.
I have a Linux/Apache server running PHP 4.3.2 with one domain on it. Let's call it foo.com. The domain has the usual 'www' subdomain plus another subdomain, 'secure'. I have set up the httpd.conf file so that the documentRoot for secure.foo.com is /home/foo/secure and the documentRoot for www.foo.com is /home/foo/www. The two subdomains also have unique IP addresses.
Here's the applicable section of the httpd.conf file (the IP addresses and paths have been changed to protect the ignorant):
NameVirtualHost 1.2.3.4:80
<VirtualHost 1.2.3.4:80>
DocumentRoot /home/foo/www
ServerName www.foo.com
ServerAlias foo.com
</VirtualHost>
<VirtualHost 5.6.7.8:443>
DocumentRoot /home/foo/secure
ServerName secure.foo.com
SSLEngine On
SSLCertificateFile /path/to/foo.com.crt
SSLCertificateKeyFile /path/to/foo.com.key
</VirtualHost>
The DNS for the domain (foo.com) is set up as follows:
<SOA and other stuff...>
IN A 1.2.3.4
mail IN A 2.3.4.5 ;mail on another server
www IN A 1.2.3.4
secure IN A 5.6.7.8
With this setup, www.foo.com only accepts http traffic and secure.foo.com only accepts SSL (https) traffic.
If I start a PHP session on http://www.foo.com/page.php I can access all of the values I toss into the session from any page on the site. However, as soon as I pull up a page on https://secure.foo.com (and call session_start), the session variables are not there (print_r ($_SESSION) outputs 'array ()').
I have session.cookie_domain in php.ini set to 'foo.com' (I also tried '.foo.com').
It's my understanding that cookies -- including session cookies -- are supposed to be available across subdomains. Does the fact that the subdomains are using different transfer protocols (http v. https) make a difference?
I've looked everywhere for an answer to my problem. Please put me out of my misery and tell me it's something stupid I've overlooked!!!
I'm having a problem accessing a PHP session across subdomains.
I have a Linux/Apache server running PHP 4.3.2 with one domain on it. Let's call it foo.com. The domain has the usual 'www' subdomain plus another subdomain, 'secure'. I have set up the httpd.conf file so that the documentRoot for secure.foo.com is /home/foo/secure and the documentRoot for www.foo.com is /home/foo/www. The two subdomains also have unique IP addresses.
Here's the applicable section of the httpd.conf file (the IP addresses and paths have been changed to protect the ignorant):
NameVirtualHost 1.2.3.4:80
<VirtualHost 1.2.3.4:80>
DocumentRoot /home/foo/www
ServerName www.foo.com
ServerAlias foo.com
</VirtualHost>
<VirtualHost 5.6.7.8:443>
DocumentRoot /home/foo/secure
ServerName secure.foo.com
SSLEngine On
SSLCertificateFile /path/to/foo.com.crt
SSLCertificateKeyFile /path/to/foo.com.key
</VirtualHost>
The DNS for the domain (foo.com) is set up as follows:
<SOA and other stuff...>
IN A 1.2.3.4
mail IN A 2.3.4.5 ;mail on another server
www IN A 1.2.3.4
secure IN A 5.6.7.8
With this setup, www.foo.com only accepts http traffic and secure.foo.com only accepts SSL (https) traffic.
If I start a PHP session on http://www.foo.com/page.php I can access all of the values I toss into the session from any page on the site. However, as soon as I pull up a page on https://secure.foo.com (and call session_start), the session variables are not there (print_r ($_SESSION) outputs 'array ()').
I have session.cookie_domain in php.ini set to 'foo.com' (I also tried '.foo.com').
It's my understanding that cookies -- including session cookies -- are supposed to be available across subdomains. Does the fact that the subdomains are using different transfer protocols (http v. https) make a difference?
I've looked everywhere for an answer to my problem. Please put me out of my misery and tell me it's something stupid I've overlooked!!!
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I should have known -- It was something stupid I overlooked.
I didn't realize I had to restart Apache after making changes to php.ini.
For future EE users who may encounter the same problem: in order for cookies (session or otherwise) to be available across subdomains, you must do as Diablo84 (and the PHP manual) says: set the cookie_domain to .foo.com. You can do this either by changing the session.cookie_domain value in your php.ini file or by calling ini_set ("session.cookie_domain", ".foo.com") before you call session_start ().
Funny enough, I had tried both methods yesterday. Neither worked. The php.ini change obviously didn't work because I neglected to restart Apache. Why the second method (ini_set ...) didn't work is beyond me. All I know is I came in this morning and the session data were magically available across my subdomains.
Could be that Apache restarted overnight. Could be that the session ID I was using yesterday kept getting recycled and GC cleaned it up overnight. Either way, it's working now.
Although the problem "fixed itself", I'll give the points to Diablo84 since he reminded me that I have to restart Apache.
Thanks, experts!
I didn't realize I had to restart Apache after making changes to php.ini.
For future EE users who may encounter the same problem: in order for cookies (session or otherwise) to be available across subdomains, you must do as Diablo84 (and the PHP manual) says: set the cookie_domain to .foo.com. You can do this either by changing the session.cookie_domain value in your php.ini file or by calling ini_set ("session.cookie_domain", ".foo.com") before you call session_start ().
Funny enough, I had tried both methods yesterday. Neither worked. The php.ini change obviously didn't work because I neglected to restart Apache. Why the second method (ini_set ...) didn't work is beyond me. All I know is I came in this morning and the session data were magically available across my subdomains.
Could be that Apache restarted overnight. Could be that the session ID I was using yesterday kept getting recycled and GC cleaned it up overnight. Either way, it's working now.
Although the problem "fixed itself", I'll give the points to Diablo84 since he reminded me that I have to restart Apache.
Thanks, experts!
Also please try these links:
https://www.experts-exchange.com/questions/20831959/Session-Cookies-and-sub-domains.html
https://www.experts-exchange.com/questions/20994355/Sessions-and-subdomains.html
Hope it helps!