Question

I’m trying to send the PHPSESSID via a HTTP GET variable for a cookie-less client.

I’ve seen this in various drupal implementations where ?PHPSESSIONID=123ABC is appending to each link, but how do I specify this in PHP and is there any way of changing the GET parameter so it could be ?token=123ABC, or even sent via HTTP POST?

Standard LAMP stack, running the Zend framework.

Thanks!

Answer 1

Using a cookie or not is configured by these PHP options :

• session.use_cookies
• session.use_only_cookies

If the first one is set, cookies will be used if possible.

PHP should detect if cookies are enabled or not, and use them only if they are supported by the client.

To enable passing of the session id by GET instead of cookies, you might have to activate session.use_trans_sid, which is disabled by default (Which means that, by defaut, session id is only passed by cookies — never by GET).

But note that, with this option activated, PHP will pass the session id by GET at least for the first page each user of your site will come to… as they won’t have the cookie at first, and the only way to check if they support cookies is by setting one, and trying to read it back on the next page.

And users that don’t support cookies, including search engines I’d probably say, will have that session id — and that is not nice 🙁

And, you might also want to take a look at session.name to set the name of the key (set to to “token” instead of “PHPSESSID”, I mean)

For more details, you can take a look at the Session Handling section of the manual 🙂