[RESOLVED] Warning: session_start(): Cannot send session cookie

sunshine66

I just switched hosting companies. All my code worked before, now I'm getting this error upon user authentication (username/pw is compared to SQL db) and redirection to proper page (error if fails, extranet if valid)

Can someone tell me what this means?

Warning: session_start(): Cannot send session cookie - headers already sent by (output started at /home/httpd/vhosts/ecbp.com/httpsdocs/customer/portal.php:9) in /home/httpd/vhosts/ecbp.com/httpsdocs/customer/portal.php on line 65

Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at /home/httpd/vhosts/ecbp.com/httpsdocs/customer/portal.php:9) in /home/httpd/vhosts/ecbp.com/httpsdocs/customer/portal.php on line 65

line 65 reads as:
$SESSION['valid_log'] = array($SERVER['REMOTE_ADDR'], $User);

subwayman

Easy one this. look through all the files that go to make up your page and find white space that effectively 'starts' the page to the browser before your php tries to infuence the headers. Consider the following:

if (!isset($_session['username']) {

header("Location: ")."login.php";

}

This will fail with your error message if there is ANY white space before the opening php script tags ('<?'). If you have lots of includes at the head of your php pages then you need to check every one for the same problem.

sunshine66

The error occurs on both pages: login.php, portal.php

okay, so the php was in the body of the html page.
i moved it to right after the head tags and stripped all space.
still getting same error message but without any html formatting

like i said it works just fine on another server.
i'm wondering if it's a php version issue: the old/current service uses 3.4.8 while the new service uses 3.4.4

here is the php that starts the session:
login.php - validates user & if valid, starts session & redirects to extranet

// start session
session_start();
$SESSION['User'] = $User;
$SESSION['FirstName'] = $FirstName;
$SESSION['LastName'] = $LastName;
$SESSION['CompanyID'] = $CoID;
$SESSION['valid_log'] = array($SERVER['REMOTE_ADDR'], $User);

Here's the php that checks the session on extranet pages (portal.php):

<?php
session_start();
if ($SESSION['valid_log'][0] != $SERVER['REMOTE_ADDR'] ||
$SESSION['valid_log'][1] != $SESSION['User'])
{
//redirect to error page
echo '<META HTTP-EQUIV="Refresh" Content="1; URL=../error_access.html">';
exit();
}
?>

The error occurs on both pages: login.php, portal.php

subwayman

It needs to be BEFORE any HTML, even the HEAD tags.

As soon as the server processes ANYTHING not in script tags it will push it's own headers out. Most user authentication code is placed right at the start of the file so the VERY FIRST characters in the files are <?PHP...

I don't understand why it would work on one server and not another but it could be that the PHP environment is set up NOT to use cookies for sessions - in which case the server does not need to send cookie headers when you start a session. Or session_autostart is set which establishes a session automatrically for every request.

ctsiow

I was having the same problem. Thanks for this answer!

c_hadpidkar

subwayman;10667180 wrote:
It needs to be BEFORE any HTML, even the HEAD tags.

As soon as the server processes ANYTHING not in script tags it will push it's own headers out. Most user authentication code is placed right at the start of the file so the VERY FIRST characters in the files are <?PHP...

I don't understand why it would work on one server and not another but it could be that the PHP environment is set up NOT to use cookies for sessions - in which case the server does not need to send cookie headers when you start a session. Or session_autostart is set which establishes a session automatrically for every request.

Thank u subwayman,it's working

r_ca02

subwayman;10667180 wrote:
It needs to be BEFORE any HTML, even the HEAD tags.

As soon as the server processes ANYTHING not in script tags it will push it's own headers out. Most user authentication code is placed right at the start of the file so the VERY FIRST characters in the files are <?PHP...

I don't understand why it would work on one server and not another but it could be that the PHP environment is set up NOT to use cookies for sessions - in which case the server does not need to send cookie headers when you start a session. Or session_autostart is set which establishes a session automatrically for every request.

Thank you, this worked for me too. I used the same code on two different homepages!