Jump to content


Photo

Simple Session Question


  • Please log in to reply
4 replies to this topic

#1 pullahomer

pullahomer
  • New Members
  • Pip
  • Newbie
  • 3 posts

Posted 27 April 2006 - 05:57 PM

Here is a simple piece of code:

<?php
session_start();
echo SID;
?>

The SID displays the first time the page is loaded but disappears after reload. I though the SID gets passed each time within the same session. If this is not true, how does server know the user is still in the same session?

Pull

#2 wildteen88

wildteen88
  • Staff Alumni
  • Advanced Member
  • 10,482 posts
  • LocationUK, Bournemouth

Posted 27 April 2006 - 06:17 PM

PHP creats a cookie on the users computer which contains the session id. PJP creates a cookie every time you intiate session_start if PHP was unable to set a cookie it puit the PHPSESSID in the URL instead or as a hidden form field, if you are using forms.

#3 pullahomer

pullahomer
  • New Members
  • Pip
  • Newbie
  • 3 posts

Posted 28 April 2006 - 01:10 AM

Thanks for the reply. I am still puzzled by the fact that the SID didn't show when the page reloaded. I set my IE to accept any cookies. I also checked the server tmp/ directory and the SID was there and didn't change when the page reloaded.

Here is what I thought what should be happening:

client sends request (with session_start statement) to the server -->
server generates a SID and sends it back to the client and it is stored as cookie -->
page reloads, client sends second request to the server (I assume the cookie is sent along with the request) -->
server opens a session, or, if the session ID sent by client matches the stored session ID, it resumes the same session and send the SID back to the client.

If my thought process were correct, the same SID should be sent back forth and I should be able to grab it. However, SID only shows on the initial page load not on reload? Apparently I am missing something.

Pull

#4 pullahomer

pullahomer
  • New Members
  • Pip
  • Newbie
  • 3 posts

Posted 28 April 2006 - 03:48 AM

I guess I just answered my own question.

1. Cookie is sent along with the client request to the server.
2. Server verifies the cookie then takes actions accordingly.
3. Server does not send the session ID back unless it is explicitly coded, i.e., appending the session ID to the URL. Server only serves as a cookie verifier. If cookie does not match the record on the server, a new cookie is generated and sent to the client (of course you need to have session_start to have the cookie generated).
4. SID is generated only when the client rejects cookie, i.e., no cookie is returned to the server. Then SID can be propagated to the link to pass the session ID back forth.
5. When you have cookie enabled, session_id() is the way to catch the session ID, not SID.

Just want to share my findings. It drove me nuts for a few days. As much as I like PHP, the PHP documentation does not provide a great deal of help.

Pull

#5 toplay

toplay
  • Staff Alumni
  • Advanced Member
  • 973 posts

Posted 28 April 2006 - 04:28 AM

FYI: Our session troubleshooting guide:
[a href=\"http://www.phpfreaks.com/forums/index.php?showtopic=31047&view=findpost&p=157705\" target=\"_blank\"]http://www.phpfreaks.com/forums/index.php?...ndpost&p=157705[/a]




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users