Session Cookies

MGSteve

Hi, as a security measure, I'm trying to replace the PHPSESSID cookie that automatically gets generated with a different one of my own. What I can't seem to do is delete any cookies that I've generated, including the PHPSESSID one.

setcookie(session_name(),'', time() - 36000);

is the line I'm using to try and delete the cookie, but after the page loads in NS7, I check the Cookie manager and PHPSESSID is still there, with the session ID (its not even setting the cookie to a '' as the above line should).

Another cookie I created to test to see if cookies were enabled in the user's browser also isn't being deleted.

Am I missing something really obvious here as I'm tearing out what little hair I left!

FYI, the session ID I'm sending to the client is an index into a DB which contains the actual Session ID, which is then read and used, but a check is also made against the IP - adding a bit of security and protection against Session hijacking.

Any help would be appreciated.

Regards

Steve Childs.

stezz

so.. you're setting a cookie the value of a session?

well.. if there's a session registered, then the only way to delete that session is to do a session_destroy() on it.

I would suggest destroying the session first, then deleting the cookie.

Hope it helps!

Regards, Stezz.

MGSteve

Hi, sorry - my own fault - didn't describe it well!

I want to keep the session, but I don't want PHP to create the PHPSESSID cookie, I can't see a way to stop this, apart from changing the PHP config files, which I don't want to do as it would effect every site on the server - I only want this website in particular to not use PHPSESSID cookies, not every site on my server.

Hope thats clearer!

xblue

Hi,

instead of changing the config file, perhaps you could use ini_set() to switch the settings temporarily? According to the documentation it should be possible to change session.use_cookies at runtime.

http://www.php.net/manual/en/function.ini-set.php

MGSteve

Hi Blue, thanks for that. Just read the function definition for ini_set and it doesn't say that the effects are localised to that script - are you positive changes only take effect for the life time of the script?

Ahh, actually just looking at the page again, according to the PHP_INI_* constants, they can also be set in the .htaccess file, which would solve my problem.

Cheers Blue 😃

Regards

Steve.