Multiple Sessions in Parent-Child Windows

rivka

I have a site that has an admin area which lists all the users -- clicking a link within that admin area will then open a new window and automatically log you in as that user.

Problem: the session data in the new window overwrites the session data in the original window, so that you are suddenly no longer logged in as an admin in the parent window, but as the user from the popup/child.

I believe I want to use session_name() to indicate that these are two separate sessions, right? But session_name() has to be used before session_start() -- so how am I supposed to know which session I am in, so that I can name the session correctly on each page? Am I going to have to pass a variable to every page within the pop-up to indicate which session I am in?

Am I making any sense? 😕

devinemke

in the parent window do:

session_name('admin');
session_start();
// rest of code

in the popup do:

session_name('user');
session_start();
// rest of code

toplay

PHP sessions really work best when there's only one session per user.

Changing the session name is not enough. Yes, a new session cookie will be created and the users/client machine will be able to create two separate cookies (given that you change the session name). However, on the server side, the sessions are stored in a designated folder and the filenames are called "sess_xxx". Where "xxx" is the session ID. So, there will still only be one session file even though you can have two different session names.

You would have to also have a different session ID. See session_regenerate_id() function:
http://us3.php.net/manual/en/function.session-regenerate-id.php

But I think you'll have to build your own, because the regenerate is to alter the ID of an existing one. Use session_id('xxx') before a session_start().

Then the only way for PHP to pick up the correct session cookie (because they'll be two) is for you to pass the session name and ID in the URL (which is more of a security risk). I would use session_name() and session_id() for that. The SID constant should be used on all redirects you have (like with the header() with location command).

rivka

It's not that easy, unfortunately. Both the admin and user are accessing the same set of code, but some is just available to the admin that is not to the user. So there's no "user" set of code, and no "admin" set of code that would make it so I could easily know what the session_name should be on that page -- they're all using the same code.

That was in reply to the first reply.

netlynx

toplay wrote:
Then the only way for PHP to pick up the correct session cookie (because they'll be two) is for you to pass the session name and ID in the URL (which is more of a security risk).

May I suggest adding a child/parent relationship to the sessions? Curious if that would work (rather than sending the information via a header request), add something like:

$_SESSION['childSessionID'] = $newSessionID; $_SESSION['childSessionName']='user';

This would at least create LESS of a security risk. Then in the script, test to see if $_SESSION['childSessionName'] is set and activate that one (though it would trip over itself because then you would have a problem loading the page with the parent ID because it would always see the child ID once it was created.)..

Thoughts?

netlynx

rivka wrote:
Both the admin and user are accessing the same set of code, but some is just available to the admin that is not to the user.

Might I suggest separating the admin code from the user code for a little added security? (I am sure a lot of the reusable stuff you could access from an admin script and a user script, but just take the admin functionality out and separate it for security reasons).

Just my thoughts, thats how I handle my scripting.

rivka

Normally I would do so as well, but the words "admin" and "user" are a bit of a misnomer here that I used so it would make sense when explaining the problem -- it's a hierarchal relationship with multiple levels, and it does make sense for them to be accessing these pieces of info as they are. I'd explain more, but it's work related -- trust me that within the confines of why and how this is written the way it is, it needs to stay this way 🙂

I'll have to think about your suggestion -- I was trying similar stuff before, but the problem I'm having is, how can you "test to see $_SESSION['childSessionName'] is set and activate that one" without calling session_start() to access the session data? It's an unworkable circle -- you'd be storing some info in the session data, but you can't access it until you call session_start() at which point it's to late to set which session you are using, since session_name has to be set before session_start, no?

toplay

As mentioned, that it's best to have one session. Try and see if you can use one to do whatever it is you're trying to do because I don't understand it fully.

It seems to me by your last post that you could or need to use regular cookies since $_COOKIE values will be available at the start of a script (and before any session_start). So, maybe a technique of using regular cookies in combination with sessions.

Good luck.

netlynx

rivka wrote:
I'll have to think about your suggestion -- I was trying similar stuff before, but the problem I'm having is, how can you "test to see $_SESSION['childSessionName'] is set and activate that one" without calling session_start() to access the session data? It's an unworkable circle -- you'd be storing some info in the session data, but you can't access it until you call session_start() at which point it's to late to set which session you are using, since session_name has to be set before session_start, no?

Yeah, I have been pondering that as well (from about the time I mentioned it last night haha, anyhow, what about this. In your code, how about adding page id's to your pages that get parsed and passed to the next page.

For example

<input type='hidden' pageID='childPage'>

Then in your script, you could have

if($_SESSION['childSessionActive' == true) {
 $UserLoggedIn = $_SESSION['childSessionUser'; } else {
 $userLoggedIn = $_SESSION['mainSessionUser';
}

then you can use the same session, but have different values for what user is logged in based on what 'page' they are on, rather than having a separate sessionID for each.

devinemke

toplay wrote:
Changing the session name is not enough. Yes, a new session cookie will be created and the users/client machine will be able to create two separate cookies (given that you change the session name). However, on the server side, the sessions are stored in a designated folder and the filenames are called "sess_xxx". Where "xxx" is the session ID. So, there will still only be one session file even though you can have two different session names.

this is not true, at least not on my machine. do the following test:

page1.php

<?php
session_name('one');
session_start();
$_SESSION['var'] = 'this is a session var in session one';

echo '<a href="page2.php">page2.php</a>';
?>

page2.php

<?php
session_name('two');
session_start();
$_SESSION['var'] = 'this is a session var in session two';
?>

after loading page1.php and then following the link to page2.php, in my session.save_path folder i have two separate session files with separate session id's.

toplay

I'm wrong. I guess PHP knows that when you change the session name, it should create a new session ID. It does it automatically instead of you having to do it. That's the way I would expect it to be, but I didn't think it did it automatically considering the session file naming convention of "sess_xxx". Thanks for testing it for me devinemke. The PHP programmer community got it right.

rivka

after loading page1.php and then following the link to page2.php, in my session.save_path folder i have two separate session files with separate session id's.

What happens if you go back to page1.php, though, and reload the page? What session is it using?

toplay

rivka wrote:
What happens if you go back to page1.php, though, and reload the page? What session is it using?

Why don't you just try it? You'll get that correct session because of the use of session_name('xxx') before the session_start().

rivka

Is there any security risk to passing the session name through the URL in the pages? That's basically all I need to make this work. I know there's a risk with passing the sesssion ID, but would the session name be a security risk?

toplay

rivka wrote:
Is there any security risk to passing the session name through the URL in the pages? That's basically all I need to make this work. I know there's a risk with passing the sesssion ID, but would the session name be a security risk?

No, not as much risk of course.

Remember though about people who do not accept sessions cookies. If your 'session.use_trans_sid' setting is on, then PHP will automatically add the session name and ID in the URL when the user doesn't accept cookies. You do manual have to pass the session name and ID in any redirects you do (in the case where a session cookie was not created). You can use the SID constant for that. Example:

header('Location: http://www.example.com/script.php?' . SID);
exit;

If a session cookie is created, then the SID won't have anything in it. But no cookie means the SID will have "session name=session ID" in it.

If you're going to pass the session name as well yourself, then come up with a different URL variable to use (i.e. sess_name).

hth.