Hello, any session gurus?
I have a strange problem with sessions.
I updated my member-pages to this new version:
https://github.com/ug2215/RegistrationForm
From start, created a new members with new sanize-functions, login was succesful. And after session lifetime, it destroyed session, but did not create a new-one.
After this session lifetime, new logins cannot be made. It just flash on screen, and keep login-page on.
But,
As i have still the old site alive, with old version of member-pages. When i login thru it, login works normally. Logout there, and login again to new-site, login goes thru normally!
So the old-site login somehow clears the destroyed session, cookies???
Something is wrong with this code. Tried to replace session parts from old code to this new, but no luck with my coding skills....
Any idea, what could be wrong in this part of code?
function CheckLogin()
{
// Check that they at least have a session, and if not, create it
if(!isset($_SESSION)){
session_set_cookie_params(3600,'/','',true,true); // make it expire after 1 hour
session_start();
}
// If they do not have a CSRF token, set that too; if we are requiring them.
if ($this->CSRFTokenRequired) {
if (!isset($_SESSION['CSRFtoken'])) {
$token = hash("sha512",mt_rand(0,mt_getrandmax()));
$_SESSION['CSRFtoken'] = $token;
}
}
// This would mean that they are not logged in, as we set this when a user logs in
if(empty($_SESSION['username']))
{
http_response_code(401);
return false;
}
// They were properly logged in, but that was too long ago (sessionLifeTime) so they need to login again
if (isset($_SESSION['LAST_ACTIVITY']) && (time() - $_SESSION['LAST_ACTIVITY'] > $this->sessionLifeTime)) {
/* last request was more than sessionLifeTime ago*/
session_destroy(); // destroy session data in storage
http_response_code(401);
return false;
}
// They are properly logged in, so let's update their session timers as appropriate.
$_SESSION['LAST_ACTIVITY'] = time(); // update last activity time stamp
if (!isset($_SESSION['CREATED'])) {
$_SESSION['CREATED'] = time();
} else if (time() - $_SESSION['CREATED'] > $this->sessionLifeTime) {
/* session started more than sessionLifeTime ago*/
session_regenerate_id(true); // change session ID for the current session and invalidate old session ID
$_SESSION['CREATED'] = time(); // update creation time
}
return true;
}
