Question

I’m having problems with cookies on my website. After validating user credentials, the following code is executed if “remember me” is set:

session_start();
    $_SESSION['username'] = $myusername;
if(isset($_POST['remember'])){
        setcookie("cookname", $_SESSION['username'], time() + 60 * 60 * 24 * 100, "/");
}

Every page on the site then has the following code at the beginning:

session_start();

if(isset($_COOKIE['cookname']) && !isset($_SESSION['username'])){
    $_SESSION['username'] = $_COOKIE['cookname'];
}

If I close the browser window and then open it again, the website has the login prompt even if “remember me” was set. Oddly, if I close just the tab for the website and then go back to it, it remembers that I logged in. What’s going on?

Thanks in advance,

Matt

Answer 1

1. Don’t store passwords in cookies.
2. You need to call session_start before storing anything into the session.
3. In many browsers (e.g. Firefox), you can view the cookies that are actually set. You can also view the HTTP headers in Fiddler or LiveHTTPHeaders. This should help debugging.