Question

A few hours ago, I’ve created a thread here regarding a session which doesn’t exist anymore when switching to http://www.. This should have fixed this:

session_set_cookie_params(0, '/', '.'.$_SERVER['HTTP_HOST']);

According to several examples on php.net and other websites, this should be correct. When going to the website without using www. and then switching to http://www., the session still works (I’m still logged it), but for some very strange reason, it’s not possible to create the session (so to log in) on the website when using www. now.

So I can login when not using http://www., I can switch to www. so the session still exists, but I can’t login when using www.

Can anyone please explain this behaviour and how I can fix this? Also, is using that server variabele safe?

Thank you!

Answer 1

If you request some resource from http://www.example.com, the cookie will be set with .www.example.com, so it will only be valid for http://www.example.com and all its subdomains but not example.com.

Just remove the leading www. before prepending the ., for example:

$domain = '.' . preg_replace('/^www\./', '', strtolower($_SERVER['HTTP_HOST']));