SESSIONs with subdomain?

[EchoFool]

If i set a session on my main domain.com will that same session still work under a domain like www.subdomain.domain.com ?

 

Because at the moment my script doesn't appear to like it - has any one managed to achieve this?

[TeddyKiller]

I haven't tried it but I'm assuming it'll be like that because it is infact a different domain.

However.. I could be wrong.

[EchoFool]

Hmm that would be a pain if your correct as that would mean my idea can't work Wanted one session to work across all my subdomains

[Ruzzas]

i think they disabled it for a reason. so hackers cant hack lol

[EchoFool]

uhh what ? Why would that add to hacking?

[TeddyKiller]

Shared servers are very high to hacking with sessions unless having your own session folder.

Other than that, I don't know of any reasons.

[greatstar00]

use mysql session then

create a mysql table, named sessin

when someone open a session, store to the mysql database (set timestamp)

when certain time, clean the sessions

then u can achieve it across domain, even across server session

 

choose a mysql server that u can connect use a ip, or domain

[PFMaBiSmAd]

None of that is necessary.

 

If you A) read the session handling section of the php.net documentation - http://us2.php.net/manual/en/book.session.php (i.e. you are trying to incorporate sessions into your script, you must read the documentation for what you are doing to be affective at doing it) you will B) find that there is a session.cookie_domain setting that will allow the session cookie to match all sub-domains/host-names of your domain.

[EchoFool]

So where do i put the session.cookie_domain to set it to my domain ? On every page?

[EchoFool]

I put this:

 

session_set_cookie_params(0, '/', '.edited-out.com');

session_start();

 

Didn't do anything though =/

 

The handling section just said~:

 

   To implement database storage, or any other storage method, you   will need to use session_set_save_handler() to   create a set of user-level storage functions. 

Don't see how that helped at all.

 

[EchoFool]

Okay i tried this aswell in my php.ini file:

<?php
// The domain for which the cookie is valid.
session.cookie_domain = .edited-out.com
?>

 

still not working, user logs in on main domain then when they go to subdomain the session is not set anymore even though i still have session start =/

[PFMaBiSmAd]

Based on what you have stated you are doing, setting the session.cookie_domain (as long as it is being set the same before every session_start()) should work. What have you done to troubleshoot what it is doing?

 

Are full php error_reporting/display_errors on so that you would know if the session is starting without errors (i.e. would sessions work at all in both pieces of code even without changing sub-domains)? Is the session cookie being sent to your browser and is the value in the session cookie the the same that session_id() shows that php is using on each page?

 

Show us the two different URL's you are using. xxxxx out any sensitive information but don't change any of the other parts of the whole urls that you are using.

[EchoFool]

Well here it is, in more detail:

 

www.xxxxxx.com/login.php

 

this script has:

<?php
session_start();  
?>

 

Before i edited the php.ini i had:

<?php
session_set_cookie_params(0, '/', '.edited-out.com');
session_start();  
?>

 

 

And when user logged in successfully  $_SESSION['Current_User'] = $UserID; (lets say 1)

 

Now a user clicks a link which takes them to www.test.xxxxxx.com/index.php

 

This has:

<?php
session_start();  
?>

 

Before i edited the php.ini i had:

<?php
session_set_cookie_params(0, '/', '.edited-out.com');
session_start();  
?>

[EchoFool]

bump

[EchoFool]

bump again

[DavidAM]

No offense intended, but did you actually use 'edited-out.com' or did you use 'yourdomain.com'?

 

If your main url is www.MyDomain.com and your sub-domain is www.test.MyDomain.com, then I think the setting would be:

 

session_set_cookie_params(0, '/', '.MyDomain.com');

 

I've never used this, but I want to make sure you set the right value.

[EchoFool]

I used my real domain, the edited - out .com was just for posting purposes as so i don't have my site posted in the forum

[EchoFool]

I forgot to ask - should there be a full stop before he "mydomain.com" ?

[TeddyKiller]

Try it with, and without and see which way works.

[EchoFool]

Nope still doesn't work either way