PHP Sessions across sub domains

dragonmantank_204 0
Viewed 94966

I am trying to set up the following:

auth.example.com
sub1.example.com
sub2.example.com

If the user visits sub1.example.com or sub2.example.com and they are not logged in, they get redirected over to auth.example.com and can log in.

sub1.example.com and sub2.example.com are two separate applications but use the same credentials.

I tried setting the following in my php.ini:

session.cookie_domain = ".example.com"

but it doesn't seem to be passing the information from one domain to the other.

[Edit]

I tried the following:

sub1.example.com/test.php

session_set_cookie_params(0, '/', '.example.com');
session_start();
print session_id() . "<br>";
$_SESSION['Regsitered'] = 1;
echo '<a href="http://auth.example.com/test.php">Change Sites</a>'

auth.example.com/test.php

session_set_cookie_params(0, '/', '.example.com');
session_start();
print session_id() . "<br>";
$_SESSION['Checked'] = 1;
print_r($_SESSION);

The session IDs are exactly the same but when I dump out the $_SESSION variable it doesn't show both keys, just whatever key I set under each domain.

session cross-domain authentication php
16 Answers

Try using:

session.cookie_domain = "example.com"

Instead of:

session.cookie_domain = ".example.com"

Note the missing period at beginning.

Be careful using this, though, because it is not supported by all browsers.

user_1285460

Had this exact problem - I wanted session values created on x.example.local to be available on example.local and vice-versa.

All solutions I found said to change the Session domain by using php_value session.cookie_domain .example.local in .htaccess (or via php.ini or via ini_set).

The catch was I was setting the session.cookie_domain for all subdomains (so far ok) but also for the main domain. Setting the session.cookie_domain on the main domain is apparently a no-no.

Basically the way it worked for me:

  • set the session.cookie_domain for ALL SUBDOMAINS.
  • don't set it for the main DOMAIN

Oh yes, please make sure the domain has a TLD (in my case .local). Http protocol doesn't allow cookies/sessions to be stored on a domain without .tld (ie localhost won't work, but stuff.localhost will).

EDIT: Also make sure you always clear your browser cookies while testing/debugging sessions across subdomains. If you don't, your browser will always send the old session cookie which probably doesn't have the correct cookie_domain set yet. The server will revive the old session and therefore you'll get false negative results. (in many posts it's mentioned to use session_name('stuff') for the exact same effect)

user_30617520

I solved it like this

ini_set('session.cookie_domain', '.testdomain.example');
session_start();

Because I was working on localhost 

ini_set('session.cookie_domain', '.localhost');

wasn't working, it sees .localhost as the toplevel instead of .com/.local/... (I suspect)

user_5166970

I get the idea that you don't want something like OpenID, like Joel is suggesting, but that you want to have access to the session data across multiple domains.

The only possibility that I can think of as a solution for that problem is to store the sessiondata in a database, and pull it out of that database.

user_1238440

Use :

session_name("put_a_session_name");
session_start([
  "cookie_domain" => ".example.com",
  "cookie_path" => "/"
]);
user_96315240

A quick and dirty solution is to use this for your redirect:

header( $url.'?'.session_name().'='.session_id() );

this will add something along the lines of ?PHPSESSID=etnm7kbuf5lg0r6tv7je6ehtn4 to the URL, which tells PHP the session id it should use.

user_1305330
Related