sessions

[powlow]

in trying to authenticate a user, i use a session.

i include a file in all the files i want protected. file looks like :

?

if ( ( !isset( $PHP_AUTH_USER )) || (!isset($PHP_AUTH_PW))

|| ( $PHP_AUTH_USER != 'news' ) || ( $PHP_AUTH_PW != 'letmein2send' ) ) {

header( 'WWW-Authenticate: Basic realm="Private"' );
header( 'HTTP/1.0 401 Unauthorized' );
echo 'Authorization Required.';
?>
<form action=index.php method=post>
User Name : <input type=text name=PHP_AUTH_USER><br>
Password : <input type=password name=PHP_AUTH_PW><br>
<input type=hidden name=startsession value=1>
<input type=submit value=Authenticate>
</form>
<?
exit;

}

else if ($startsession == 1){
#header("Content-type: text/html");
$seshpath = ".\sessions";
session_save_path($seshpath);
session_start();
session_register("PHP_AUTH_USER");
session_register("PHP_AUTH_PW");
$startsession = 0;
session_register("startsession");

}

else {

echo "Logged in";
#something to logout maybe
}

?>

creates the session fine in a directory i define myself. problem is when i go to another page, i get sent to the authentication part instead of the session being recognised. what am i missing?

thanks for any help
-powlow

[feigenblatt]

You have to use session_start() in every page.
It tells your script to fetch the session info from the disk (or db), or to start a new session if one doesn't exist.

[powlow]

cheers dado!

that worked great. also added a logout button and used session_destroy to end the session and destroy the session file. however, if someone doesn't logout, the session file remains. is this configurable? i saw something about giving sessions a lifetime and also something about them being destroyed when the browser is closed through the php.ini file. any tips or pointers on this?

thanks again

powlow

[feigenblatt]

That's configurable in php.ini
(usualy found in /etc).
There's an attribute for session lifespan there, I think in either seconds or minutes.
And I think if you set it to zero it might disapear when the user closes the browser.
But it also can make it last forever. Got to read on that again 🙂
php.ini says what it does. check it out.