Session Problem

[rogeriobrito]

Hi, I have a website where users can login and edit their data. When the user logs in, I store his/her information on session variables (cookies). This was working good until lately that I have many users coming from the same company that are behind a proxy. When they login they don't get their own data, but other user's data.
I guess the proxy is delivering the sessions to the wrong users.

I could pass the session ID in the URL, right? But how do I enable-trans-sid on windows?

My setup is Win2k - IIS5 - PHP4.06

Can anyone help me please?
Thanks a lot.

[Anon]

The enable trans_id value is a php.ini configuration option. You should simply need to edit your php config file setting the option to 1 then restart your web server.

Now the questions:
1) are you using customer session callback functions?

2) since by default sessions are moved via cookies, and most proxies won't try to share cookies amoung users, have you checked to make sure your page headers are explicitly setting the "no cache" option as it may be that the proxy these users are coming from is caching the pages and serving them to multiple users

3) have you been able to debug any of the user requests to ensure that if two different users send you requests, that you get the session cookie for the appropriate user with each request?

I suspect that the 2nd item may be where your issue resides.

[rogeriobrito]

bstineman wrote:

The enable trans_id value is a php.ini configuration option. You should simply need to edit your php config file setting the option to 1 then restart your web server.

Now the questions:
1) are you using customer session callback functions?

2) since by default sessions are moved via cookies, and most proxies won't try to share cookies amoung users, have you checked to make sure your page headers are explicitly setting the "no cache" option as it may be that the proxy these users are coming from is caching the pages and serving them to multiple users

3) have you been able to debug any of the user requests to ensure that if two different users send you requests, that you get the session cookie for the appropriate user with each request?

I suspect that the 2nd item may be where your issue resides.

My php.ini has "session.use_trans_sid = 1", it is like that by default, it seems to be passing the PHPSESSID variable, but it doesn't show on any relative URLs I have. Does this work with named sessions?

To your questions:
1) I don't know what you mean, what is that?

2) This can be the solution, I don't have nocache for the pages, I'll add it.

3) No, how can I do that?

Thank you very much for your help.
Rogerio