Question

I have secured pages that all check for a set session variable to determine logged in users, pretty standard stuff. Where I run into problems is when I submit form information to a backend page that will process that data and then redirect to a success/failure confirmation page. In that time the session gets lost, at least the session with the variable. The session is still around because I can manually navigate to a secured page after and it works. Just auto redirects from a backend page to a secured page or a link on one of the unsecured pages after a redirect from the backend will fail. It may or may not be related, but after visiting multiple secured pages or doing one of the operations that use the problematic backend pages, there are two session cookies on my computer from the domain– one registered to domain.com and the other to http://www.domain.com. At the end of my wits about this, thanks.

Answer 1

I see two problems here, but they’re related.

The first is that you seem to be bouncing between secured (https://) and un-secured (http://) pages. Cookies aren’t supposed to be shared between those, so that’s why your session appears to break (PHP sets a cookie with the session ID).

The other is closely related and that is sharing between domain.com and www.domain.com. Cookies can share in one direction, but not the other. Don’t worry about which: just pick one hostname and stick with it. Then check that you’re setting the session’s cookie domain to the correct one.