Member Avatar for mrclark

I am working on sessioning scripts however my cookies are not carrying over from page to page.

I include the session script on every page which checks the $_COOKIE['session'] cookie, and if set, keeps the session data, if not, creates a guest session and sets a cookie with a new key.

I can see in my SQL Table that the key is being created, however, if I brows to a page on sub directories, it creates a new key.

http://www.example.com <- Session ID [001]
<- Session ID [002]

In the sub dir, the $_COOKIE['session'] variable is empty...

I am setting the cookies with the folling line:

setcookie("session", $SessionID, time() + 900, '/', '.example.com' );

If anyone could point me in the correct direction, that would be great.

*Note, cookie need to be accessed and set in every directory.

  • 1 Contributor
  • 3 Replies
  • 118 Views
  • 32 Minutes Discussion Span
  • Latest Post Latest Post by mrclark

Dani AI

Generated

Quick summary based on 's thread: the browser decides whether to send a cookie by comparing the cookie's Domain and Path attributes to the request host and URL path. Two very common pitfalls that produce “new session on every page” symptoms are (1) using the server filesystem path (for example $_SERVER['DOCUMENT_ROOT']) as the cookie Path and (2) a domain/host mismatch. The Path must be an URL path (typically /) and the Domain should be the registered domain you actually serve (modern browsers treat .example.com and example.com equivalently; see the RFC and MDN notes below).

Practical checks and fixes

  • Confirm the cookie Path is an HTTP path (starts with /) — not a filesystem path. Browsers match the request URL path against the cookie Path; a filesystem path will never match.
  • Inspect the cookie as set by the server using browser DevTools (Application → Cookies) or by looking at the raw Set-Cookie header (example below).
  • Make sure cookies are set before any output is sent from PHP.
  • If you serve both example.com and www.example.com, pick a canonical host (or set the cookie Domain to the registered domain) and redirect traffic consistently.

A couple of useful commands/snippets to test and set cookie parameters (use before session_start()):

# view Set-Cookie header from the server
curl -I https://www.example.com/ | grep -i Set-Cookie
# set session cookie params centrally (array form since PHP 7.3)
session_set_cookie_params([
  'lifetime' => 900,
  'path'     => '/',
  'domain'   => 'example.com',
  'secure'   => false,
  'httponly' => true,
  'samesite' => 'Lax'
]);
session_start();

References: PHP cookie/session docs ([setcookie]) and ([session_set_cookie_params]), cookie scope and attributes on MDN, and the cookie spec ([RFC 6265]).

Member Avatar for mrclark

Solved my own problem by using the following:

setcookie("session", $SessionID, time() + 900, $_SERVER['DOCUMENT_ROOT'] . '/', '.example.com' );
Member Avatar for mrclark

I lied. That initially seemed to work, but ended up creating a new session on every page visit.

Member Avatar for mrclark

Changed - .example.com to example.com
-Fixed

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.