Question

Is it possible to have the same session be active across multiple open windows in a php app?

I want to have SOME of the convenience of the dreaded “remember me” checkbox type system without the same amount of risk to the user’s data.

The specific use case I have run into is this: When a user receives a “friend request”, an e-mail is sent to them with a link that contains a random hash and their username in the url. Say the person is already logged in to my service in one window and is checking their mail for the confirmation e-mail in another. They click the link in the confirmation e-mail and it launches a third window which initiates a GET request to the relevant confirmation page. I’d like to make it so that if the user is already logged in to the service in another window and the hash and username match those stored in the “requests” table of my database, clicking the link instantly confirms the friend. However, if they are not already logged in in another window, they are then forced to log in to confirm the friend request.

Currently if a person is logged in in another window, clicking the link launches a third window and the person must log in again regardless of whether they have another open session.

Is this functionality possible without using cookies to maintain a persistent login?

Update: This question demonstrates my own lack of understanding regarding how sessions work. The user’s session IS normally preserved across concurrently open browser windows by default. The issue, as was addressed in the answer I accepted was that I had one window open with http://www.example.com as the URL and one with example.com as the URL, in which case a different session is created in the second window rather than continuing the session started in the first window.

Answer 1

If you use cookie-based sessions, the session is already maintained between windows (of the same browser executable).

The session ID is the only client-side stored token in this case, and browsers don’t generally segregate cookies between different windows.

You may have an issue in that they’re visiting your web site via two different domain names (www.example.com vs example.com vs www.example.org, or the like), but fundamentally there is no problem unless you try to use GET-passed session IDs.

You will technically “use cookies” – but the cookies only hold the session ID, not the session contents. If that is anathema to you, you could store the session ID using the HTML5 LocalData API, or with a Flash object, or a Java applet, or whatever…

I strongly advise against attempting to identify the clients a posteriori via their IP address or browser characteristics. Just have them store a token, and use that to determine who they are.