Sessions: How does PHP know to use trans_sid, not a cookie on the first hit?

ijames

Hi Gurus!

I've searched the net for trans_sid, cookies, sessions, etc... But all I get are tutorials about sessions and cookies and turning off trans_sid. Not what I'm looking for. Tough Googling!

What I want is for my PHP code to know if the browser has cookies turned off ON THE FIRST PAGE HIT. A reasonable request don't you think?

Now, I've read, the only way to do that is to write out a cookie and check on the next page hit?!?

BUT that doesn't explain how PHP already knows...

You see, if cookies are turned off, then, when PHP outputs its very first page back to the browser, it appends the PHPSESSID onto all hrefs, urls, and even adds in a hidden form field, doesn't it? Pretty clever! Some serious post processing there.

But doesn't that mean that PHP knows that it couldn't write a cookie from the very first?

So, why can't it tell me?

Somebody's got to have figured this out already right?

Thanks mucho!

Sincerely,

James

mtmosier

It doesn't know. If trans_sid is enabled it always appends the session id on the first page. Then the first time it's able to retrieve the session id from an actual cookie coming from the client it stops.

ijames

Ah ha.... Thanks.

Very interesting.

So basically on a site that you've never ever been to (where start_session() is called), the links on the first page will ALWAYS have the session id tacked to the end of them?

Also, on the second hit, both the cookie and the PHPSESSION $_GET variable will be present when cookies are allowed?

James

mtmosier

So basically on a site that you've never ever been to (where start_session() is called), the links on the first page will ALWAYS have the session id tacked to the end of them?

Unless the site changed the cookie expiration, it'll be every first visit in a new browser session. Close your browsers then visit your site, and you should see the session ids in every link on the first page, regardless of cookies.

Also, on the second hit, both the cookie and the PHPSESSION $_GET variable will be present when cookies are allowed?

Yep.

ijames

Alright,

So I've got two sites. One seems to correctly be placing cookies and not using the trans_sid, the other has suddenly started ignoring everything it seems and always displaying the session_id in the GET string.

I've got frames!

So according to the above conversation, the first time I hit either of these sites (and there's a start_session at the frame level), then the src= for each frame should have the session-id tacked on. But after that if cookies are on, it should stop. What would permanently tell php to continue sending the id on the getstring?

Also on a test page I created, I'm starting a session but still, it never seems to have the session id tacked on.

Is there some site that explains this better?

Still working on it...