[RESOLVED] Session Setting Problem

Myth_UK_

Here is a small example of the problem...

 // Logout.php
<? php
session_name('test');
session_start();
session_unset();
header('Location: https://' . $_SERVER['HTTP_HOST'] . '/login.php');
?>

// Login.php
<? php
session_name('test');
session_start();
$_SESSION['test_var'] = "hello world";
?>

The problem I am having is sporadic...
if Logout.php is run, it unsets the session data, then redirects to Login.php... Login.php then sets the $SESSION['test_var'] = "hello world". The problem is this sometimes fails, and $SESSION['test_var'] remains unset.

I have been testing this, by deleting the session cookie in my browser then running Logout.php... It seems to set the test_var normally about 2 out of 3 attempts, and fails on the third?

TheoGB

Not sure but when I do logouts in my system I unset the $_SESSION['test_var'] (well the value I use) rather than using session_unset and I just have session_start() at the top of my 'root' include file.

bradgrafelman

If you want to completely empty out all contents in the session, try adding a [man]session_destroy/man to the logout page. If you don't, then add a [man]session_write_close/man instead.

In either case, also add an [man]exit[/man] statement after the header() redirect. This makes sure that PHP finishes writing the new session file back to the server before the next request comes in and the data is read back in again.

Myth_UK_

The actual code I use for logouts looks more like this.

ini_set('session.use_only_cookies', 1);
ini_set('session.use_trans_sid', 0);
ini_set('url_rewriter.tags', '');
session_set_cookie_params(0, '/', '', 1, 1);
session_save_path('../nottelling');
session_name('test');
session_start();
session_unset();
session_destory();

// Login Redirector
header('Location: https://' . $_SERVER['HTTP_HOST'] . '/login.php');
exit();

I have used both session_write_close() and unset($SESSION['test_var']) over the last few days. The problem seems to be calling the login.php and trying to set $SESSION['test_var'] again afterwards... it works only sometimes.

bradgrafelman

Is it possible that it's just a browser cache issue? Have you tried outputting the current time (including seconds) and verifying that it's changing?

Myth_UK_

It does seem to me as if there is a delay sometimes between the data being written to the session vars, and reading them back.

The actual code I am testing isn't really to do with logins, but to detect if cookies are deleted or disabled. It also works fine apart from, this delay that sometimes makes it fail.

I don't think its a browser cache issue, I have various headers set so it dosen't cache any of the pages, and the time does update...

It's a bit strange really. If i unset the session, then set the session variable(in logout), then redirect to the login page, it will work... but this defeats the purpose.

Myth_UK_

After many hours of testing, I discovered that it was indeed a caching problem, but it was due to how the IIS server was set up for caching static and dynamic pages. I am not allowed to alter this setting (the asp.net boy’s would wet themselves if I did). So I had to come up with a work-around :glare:.

halojoy

In your script posted destroy is bad spellt: destory
Such things would normally give a syntax error
so I imagine this was only in your post here.

session_start();
session_unset();
session_destory(); //should be: session_destroy();

// Login Redirector

Myth_UK_

It was just a typo... Maybe one of the admins will edit it, since it's not offering me the option to. 😃