Question

I have a homebrew CMS installed on two different web servers. Each maintain the same code. I have had a really annoying problem when I try passing $_SESSION variables between different domains.

My CMS is on domain1.com. The website it is controlling is on domain2.com. My system passes all the session variables for the login information from domain1.com to domain2.com via a url link (domain1.com has a link like this: http://domain2.com?sessionId=1gh...)(sessionId is generated by session_id()). domain2.com retrieves the session id and does session_id($_GET['sessionId']) to set the session and grab the variables. It then proceeds to show a bar at the top with admin features.

This system works well on one of my hosts, as well as my localhost. But I recently transferred to a different host and installed my CMS with the same code with success. Everything works except for this feature. When I click on the link and try to set the session_id, the session_id changes, but the $_SESSION variables are removed. When I return to my CMS, I have to relogin. Somehow on this host, changing the session_id deletes the $_SESSION variables.

I have never liked session variables and I would not use them if I were to start again (I would probably use plain cookies). But I really need to figure this out. The host that it works on is Bluehost, with both domains hosted by Bluehost. The host that it does not work on is [EDIT]ByteHost, and the domain registrar is Godaddy.

Here is some example code from domain2.com:

…

if ( $_GET['sessionId'] )
{
 session_id($_GET['sessionId']);
}

session_start();

echo session_id(); // returns the proper sessionId passed through the url

print_r($_SESSION); // does not work. returns array()

...

I can guarantee that the $_SESSION variables existed before, because I was still logged into my CMS.

Any ideas why session variables work on 1 host, but not on another?

I tried replacing the php.ini file with the working host one. Problem was still there.

Thank you for your time!

UPDATE

I ended up removing this from my CMS. Now, I just pass the login details over the url and it logs the person in. It works a lot cleaner.

Answer 1

Here are some reasons why this may not be working:

• different physical server
• different account for each domain (even if it’s the same physical server)
• different apache/php daemon for the domains (some shared hosting sites will create a separate directory for each domain, and then restrict apache from sharing information between domains. This will also have the effect of preventing session information from being passed. Think about it – do you want someone else’s domain on the same hosting provider to have access to YOUR client’s session info?)
• configuration (apache or php), or .htaccess rules

Here is what I will recommend: stop doing this. This is a great opportunity to fix a very serious security flaw in your code. By the time you diagnose it with the hosting provider, you could probably just rewrite everything you need using HTML5 storage or secure cookies.

My guess is that the hosting provider is smart enough to protect session information form being stolen from another domain. But in either case, I strongly recommend you change the code so that it does not need to steal session information from another domain.