Question

How can I get session variables to persist across header redirects?

My header redirect looks like this: header("Location:./content/user_dash.php");

I have session_start(); at the top of every page.

I have tried before my header redirect session_regenerate_id(true);

I have tried before my header and after session_regenerate_id redirect session_write_close();

I have tried exit(0); and die(); after my header redirect;

I have tried header("Location:./content/user_dash.php?PHPSESSID=".session_id());

If I INCLUDE the end page it works (But I cannot use this) and when I change it to redirect my variables stop working. I tested this with a foreach loop through $_SESSION and it prints when INCLUDING the page, but doesn’t on redirect.

I’m kinda pulling my hair out over this because I really do need to use session variables after redirects.

File Structure:

index.php = submits login form => login_code.php = redirects after setting session vars => user_dash.php echos vars and nothing shows (empty vars, if statement to echo if isset)

I have removed the redirects and even simple hyperlinks aren’t carrying my session variables to the next page.

Live HTTP Header:

*serverinfo*/login_code.php

POST *serverinfo*/login_code.php HTTP/1.1
Host: server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: *serverinfo*
Cookie: PHPSESSID=im7kid3isj1q9ft03a68s6d5i3
Content-Type: application/x-www-form-urlencoded
Content-Length: 29
username=user&password=pass
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: PHP/5.3.10, ASP.NET
Date: Thu, 03 May 2012 16:24:54 GMT
Content-Length: 159
----------------------------------------------------------
*serverinfo*/content/admin_dash.php

GET *serverinfo*/content/admin_dash.php HTTP/1.1
Host: server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: PHPSESSID=im7kid3isj1q9ft03a68s6d5i3

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: PHP/5.3.10, ASP.NET
Date: Thu, 03 May 2012 16:24:54 GMT
Content-Length: 3474

Answer 1

You need to debug your application.

It could be a surprise for you, but debugging takes most of the programmers time. So, time to learn some of the real programmers job.

header("Location:./content/user_dash.php?".session_name()."=".session_id());

used along with session_write_close() is a most bulletproof way

if it’s still not working start debugging it.

• check the session file
• check the cookies
• check ini settings
• check session id in the user_dash.php – is it the same?
• check if you really lose all your session or may be just one variable

thank you for the ini settings.
I can see 2 suspicious ones

• session.use_only_cookies On means sending SID via url will have no effect. check session cookies AGAIN
• session.cache_expire 180 180 is way too small.

and I may overlooked some as I got not paid for the debugging your app and I have my own job to be done.
So, I’d just suggest to make all settings default and never touch them until you got to know what are you doing certainly