Cookies and server side storage

[nezbo]

Hi all

 

I am having problems with the cookies stored server side (i think), or it may be something to do with Citrix (but I doubt it very much because some users are not using Citrix).

 

The problem is that when a user is logged on and another user is trying to logon i am getting the other users cookie being used.

 

I am not to sure that is causing this, but i thought I had fixed it and now we have had a new windows server 2008 installed and the problem has come back.

 

I have setup no cashing in my php hedders :-

header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
header("Cache-Control: no-store, no-cache, must-revalidate");
header("Cache-Control: post-check=0, pre-check=0", false);
header("Pragma: no-cache");

 

and in my HTML code :-

<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
<META HTTP-EQUIV="Expires" CONTENT="-1">

 

Please can some one help, I am not to sure what I can do next i am willing to try anything. I am also not to sure why it has suddenly just started doing it again.

 

Nezbo

 

[trq]

The problem is that when a user is logged on and another user is trying to logon i am getting the other users cookie being used.

 

Can we see the code that illistrates this problem?

[nezbo]

[quote author=thorpe link=topic=218728.msg1001907#msg1001907 date=1222683865

Can we see the code that illistrates this problem?

 

My site is www.eastlancsmedicalservices.co.uk and i only have the problem when we are connecting from work. we have 10 different sites and about 200 users, in 3 different services. over 2 servers, but 1 N3 connection.

 

When a user has logged in then another user logs in it sometimes takes the other cookie from some one else maybe in another service or building etc...

 

it has only started since we have had the new server installed.

 

Is there a better way to store cookies, or do a login script, or force cookies to be client side?

[trq]

Is there a better way to store cookies, or do a login script,

 

Bit hard to tell without seeing your current implimentaion isn't it?

[nezbo]

Is there a better way to store cookies, or do a login script,

 

Bit hard to tell without seeing your current implimentaion isn't it?

 

Here is the top of the code

<?php
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
header("Cache-Control: no-store, no-cache, must-revalidate");
header("Cache-Control: post-check=0, pre-check=0", false);
header("Pragma: no-cache");
include("include/dbcon.php");
if (isset($_POST['submitLogin']))
{	
	$passwordCript = md5($_POST['Password']);
	$okLogin = @mysql_query("SELECT * FROM person WHERE UserName='" . $_POST[userName] . "' AND Password='" . $passwordCript . "' and valid='0' ");
	$num_rows = @mysql_num_rows($okLogin);
	if ($num_rows == 1)
	{
		while ($theUser = @mysql_fetch_array($okLogin))
		{
			$usernames = $theUser['CallID'];
			setcookie("user", $usernames, false, "/", false);
			setcookie("pass", $passwordCript, false, "/", false);
			echo "<meta HTTP-EQUIV='refresh' CONTENT='0'; URL='" . $_SERVER['PHP_SELF'] . "'>";
		}
	}
	else
	{
		?>
			<script type="text/javascript">
				alert ("Please enter a valid username and password");
				window.onload = history.back(1)
			</script>
		<?php	
	}
}
$cleansing = true;
include("functions.php");
$host123 = $_SERVER['HTTP_HOST'];
$self123 = $_SERVER['PHP_SELF'];
$query123 = !empty($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : null;
$url123 = !empty($query123) ? "http://$host123$self123?$query123" : "http://$host123$self123";
$trackerInsert = @mysql_query("INSERT INTO tracker (address, userID, mkTimeStamp, ipAddress) VALUES ( '" . $url123 . "' , '" . $_COOKIE['user'] . "', '" . mktime() . "', '" . $_SERVER['REMOTE_ADDR'] . "' )");
$checkIfThereIsAMessageForUser = @mysql_query("SELECT * FROM person WHERE valid = '0' AND CallID = '" . $_COOKIE['user'] . "' AND message > '0'");
while ($checkIfThereIsAMessageForUser2 = @mysql_fetch_array($checkIfThereIsAMessageForUser))
{
	?>
	<div id="messageToStaff">
	<br />
	<?php
		$getMessageInformation = @mysql_query("SELECT * FROM messagetostaff WHERE messageID = '" . $checkIfThereIsAMessageForUser2['message'] . "'");
		while ($getMessageInformation2 = @mysql_fetch_array($getMessageInformation))
		{
			echo $getMessageInformation2['messageText'];
		}
	?>
	<div style="position:absolute; right:2px; top:2px; padding:2px; background-color:#ffffff; border-style:solid; border-color:#000000; border-width:1px; ">
	<strong><a href="?messageClose=<?php echo $checkIfThereIsAMessageForUser2['message']; ?>" title="Once close has been presses this massage it will disapear">Close</a></strong>
	</div>
	</div>	
	<?php 
}

?>
<div id="fixme"></div>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd" >
<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
<script type="text/javascript" language="javascript" src="ajaxrequestvalue.js"></script>
<script type="text/javascript" language="javascript" src="ajaxrequestinnetHTML.js"></script>
<title>East Lancashire Medical Service</title>
<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
<META HTTP-EQUIV="Expires" CONTENT="-1">
<link rel="stylesheet" type="text/css" href="test.css" >
<link rel="SHORTCUT ICON" href="/images/favicon.ico" >
</head>