Question

Question is in the title.

I can access $_COOKIE['blah'] in my php file in the webroot, but I have includes outside of webroot for security purposes that can’t access it.

Example

/home/wwwroot/index.php CAN read $_COOKIE[‘blah’]

Where it’s full path would be http://www.mydomain.com/index.php.

/home/scrape/process.php CAN NOT read $_COOKIE[‘blah’]

But it is outside the webroot, and the scrape folder can’t be access outside of the server.

Index.php can echo the value stored in the cookie and will also write a timestamp with the value to a log file. This works.

Without posting ALL the code and trying to keep this simple and it’s just something simple like so:

<?PHP
include '../scrape/process.php'; // THIS FILE IS OUTSIDE THE WEBROOT
$cook=$_COOKIE['blah'];

echo "Cookie value is : " . $_COOKIE['blah'] ;
error_log('['.date("F j, Y, g:i a e O").']'.$cook."<br /> \n", 3,  $phperrorPath);
?>

<?PHP
echo 'Outer cookie is : ';
echo outer_cookie();
?>

Process.php function is called from index.php where it will then return the value of the cookie, and also write it’s own log file with timestamp and cookie value. This does not work. The log file has only timestamp with no value, and it doesn’t return anything to index.php.

function outer_cookie() 
{ 
    $cook=$_COOKIE['blah'];
    error_log('['.date("F j, Y, g:i a e O").']'.$cook."<br /> \n", 3,  $phperrorPath);
    return $cook; 
} 

How can I get process.php to read the cookie data? I obviously can’t set the cookie path to something outside of the webroot, and even if I could, then it wouldn’t be accessible to everything in the webroot…

Do I have to use $_SESSION along side the cookie? I would hate to have to duplicate the work…

Answer 1

Do make this work both file should be in your domain or subdomains of one domain.

You cannot access the cookie set in index.php in a file that does not have web access and it’s not parsed by the browser.

Check php.net:

Cookies are a mechanism for storing data in the remote browser and thus tracking or identifying return users. Cookies are part of the HTTP header, so setcookie() must be called before any output is sent to the browser.