Sessions, Cookies, and Subdomains

seek

Hello, I've a bit of a problem and was wondering if anyone out there can help straighten it out. Up until this point I have been using a very customized version of PostNuke for my website but things are to the point where I need to just make my own system from scratch. I want to use php sessions for my user system because they seem to be more transparent to the visitor, but there are a few problems that I think I am going to run into based on what I've read. I want to have my website split into several subdomains with a shared user system. That is to say that when someone logs into foo.mysite.com they'd also be logged into bar.mysite.com when they go to it. It is my understanding that php sessions will not work in this way, being that each subdomain has its own sessions. If this is the case, is there a way around this? If it is the case and there isn't a way around it, is this able to be done with regular cookies? Also, php sessions only last a certain amount of time. I'd like for users to remain logged in indefinitely if they choose to do so while logging in. Assuming this is absolutely impossible in sessions, is it feasible to use php sessions as the basis of my user system and cookies as a secondary to it if users choose to remain logged in? Any help at all would be really appreciated, because I'd like to get the new version of my site rolled out soon.

sarahk

I'm interested in your comments about the subdomain. I'm looking at using them too but I don't have quite the same requirements.

You will need cookies if you want automatic login, where a browser is closed and sometime later a new one is opened.

I've mucked about with sessions but not used them extensively yet. However I've found that the sessions expire after a timeframe you specify, provided the browser is kept open.

I'll be interested to see how this thread progresses 🙂

seek

I got a reply on the php.net mail list which said that to use sessions with multiple subdomains I need to make a custom session handler. Such a handler can be made by storing session info in the database and having all sites you wish to share the sessions access it. I did a search for php session handlers and a tutorial on this very site came up: http://phpbuilder.com/columns/ying20000602.php3

And like you said, I'll need to use cookies for the auto-login. Thanks and I hope you find the above tutorial interesting.