Jump to content

Simple Session Question


pullahomer

Recommended Posts

Here is a simple piece of code:

<?php
session_start();
echo SID;
?>

The SID displays the first time the page is loaded but disappears after reload. I though the SID gets passed each time within the same session. If this is not true, how does server know the user is still in the same session?

Pull
Link to comment
Share on other sites

PHP creats a cookie on the users computer which contains the session id. PJP creates a cookie every time you intiate session_start if PHP was unable to set a cookie it puit the PHPSESSID in the URL instead or as a hidden form field, if you are using forms.
Link to comment
Share on other sites

Thanks for the reply. I am still puzzled by the fact that the SID didn't show when the page reloaded. I set my IE to accept any cookies. I also checked the server tmp/ directory and the SID was there and didn't change when the page reloaded.

Here is what I thought what should be happening:

client sends request (with session_start statement) to the server -->
server generates a SID and sends it back to the client and it is stored as cookie -->
page reloads, client sends second request to the server (I assume the cookie is sent along with the request) -->
server opens a session, or, if the session ID sent by client matches the stored session ID, it resumes the same session and send the SID back to the client.

If my thought process were correct, the same SID should be sent back forth and I should be able to grab it. However, SID only shows on the initial page load not on reload? Apparently I am missing something.

Pull
Link to comment
Share on other sites

I guess I just answered my own question.

1. Cookie is sent along with the client request to the server.
2. Server verifies the cookie then takes actions accordingly.
3. Server does not send the session ID back unless it is explicitly coded, i.e., appending the session ID to the URL. Server only serves as a cookie verifier. If cookie does not match the record on the server, a new cookie is generated and sent to the client (of course you need to have session_start to have the cookie generated).
4. SID is generated only when the client rejects cookie, i.e., no cookie is returned to the server. Then SID can be propagated to the link to pass the session ID back forth.
5. When you have cookie enabled, session_id() is the way to catch the session ID, not SID.

Just want to share my findings. It drove me nuts for a few days. As much as I like PHP, the PHP documentation does not provide a great deal of help.

Pull
Link to comment
Share on other sites

This thread is more than a year old. Please don't revive it unless you have something important to add.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.