Question

Recently I stumbled on an interesting bug where entries would show up in our local custom-made ticket system from users that didn’t exist in the app. After some poking around I realised that both this and another PHP app running on the same server were using $_SESSION[‘user’] for authentication purposes. When someone used one system and then opened the other one he was “automatically” logged in as a user from the first app.

After the obligatory facepalm I changed the session variable name in one of the systems to stop this. However I need to make a permanent, zero-maintenance change to my session handling class to avoid this in future projects. I figure this could be done by using a unique value (for example the script path) to put an app’s variables in a place in $_SESSION that wont be used by another app.

Is there a better way?

Edit: This is on linux. And both apps are on the same website.

Answer 1

You can ensure that the Session cookies will be specific to the application by making sure that the domain and path of the cookies are set restrictively, e.g. for an application at http://www.example.com/apppath, you could do the following:

<?php

$currentParams = session_get_cookie_params();

session_set_cookie_params($currentParams['lifetime'], '/apppath/', 'www.example.com', $currentParams['secure'], $currentParams['httponly']);

session_start();

This will leave the other session settings intact.

The path is probably the important one, by default PHP will issue the cookie for the domain that the site was requested over (I think), so you could probably actually leave the domain parameter as the default.