How to create unique session id in php

Question

On our websites, we want you to be able to share sessions with multiple domains. All of these websites are on the same server, but some of them have a different IP address.

A possible solution that I found is to set the session id:

<?php session_id($someUniqueHash); ?> 

And this works if I make a hash like md5 ('test'). In another domain on the same server we have a session again.

The problem is generating an identifier. I see some solutions on the Internet with microtime, etc., but when I use this approach, I can not predict the session identifier on another domain / PHP page.

Does anyone have any ideas? Or should we not realize this? Are there other options for sharing a session over multiple domains? (NOT subdomains!)

Answer 1

I reached this system using OAuth thread, but we replaced Consumer with user.

Thus, each domain will have an authenticated Access_Token in its own session. You will then use this Access_Token to get user information from the api.

I also solved the problem of the session using session_set_save_handler and saving the sessions in the database table ... There would also be an Access_Token in this table, which makes it easy to find a session with a DB query.

Hope this helps with ideas.

Answer 2

Hmm, this is complicated.

As everyone knows, PHP uses cookies to understand session_ids when a user returns to your site and there are no cookies with cross domains: Cookies for cross domains (change: exists, but the method is complicated).

This is probably why I have never seen a site implement this, even if they have different domains.

You can use the link on your page from one domain to transfer the session identifier to the next domain via $ _GET or $ _POST. This will not work if the user directly logs into your other site.

The only partially (without reliable) method I can come up with is to save a custom Computuer entry in the database and use this to understand what this session is tied to. This way you post the IP address of the computers and possibly some other details, and this applies to the session.

The IP address and other data of the personal computer will write them to another domain.

Answer 3

This may not be an option for you, but you can try it.

On your main site, you generate a session identifier in accordance with the normal one and perpetuate the session in another domain into which you can include image tags with the session identifier in the URL. In response, another domain will set a cookie, so that when a visitor arrives there, he already knows the session ID.

It feels a bit flexible for pants, but it should work if you don't have many other domains :) third-party cookies may be disabled separately in browsers, something to consider.

Oh, btw, accepting a session (accepting an identifier through request parameters and setting a cookie) is sensitive and must be protected, that is, a session must exist before setting a cookie.

Answer 4

Set up each site separately:

 <?php $cfgsession['file'] = "../sessions_global.txt"; $cfgsession['keepalive'] = 7200; ?> 

To make multiple site sharing sessions, let them use the same $cfgsession['file'] . Turn on the session from one site in the request to another domain (possibly according to Jack’s recommendation) and until you catch them by making their request in a different browser or whatever (please something to prevent the session from being captured), let them set the session with $ _GET. For example:

 include ("../session.php"); if (isset($_COOKIE['session'])) session_begin($_COOKIE['session'], $_SERVER['HTTP_USER_AGENT'] . "+" . $_SERVER['HTTP_ACCEPT_CHARSET'], $_SERVER['REMOTE_ADDR']); else session_begin("", $_SERVER['HTTP_USER_AGENT'] . "+" . $_SERVER['HTTP_ACCEPT_CHARSET'], $_SERVER['REMOTE_ADDR']); setcookie("session", session_identity(), 0); 

And then just collapse your own session_ functions:

 <?php function session_begin($mysession = "", $key = "", $client = "") { global $cfgsession; if (!preg_match("/^[a-z0-9]{32}$/i", $mysession)) $mysession = md5(microtime()); $error = false; $client = trim($client); $key = trim($key); $cfgsession['returning'] = false; if ($chandle = @tmpfile()) { if ($shandle = @fopen($cfgsession['file'], "rb")) { flock($shandle, LOCK_SH); fputs($chandle, $mysession . " " . time() . " $" . $client . " $" . $key . "\n"); while (!feof($shandle)) { $sline = explode(" ", trim(fgets($shandle)), 4); if ($sline[1] >= (time() - $cfgsession['keepalive'])) { if (($sline[0] == $mysession) && ($sline[3] == "$" . $key)) { $cfgsession['client'] = substr($sline[2], 1); $cfgsession['returning'] = true; } elseif (count($sline) > 2) fputs($chandle, implode(" ", $sline) . "\n"); } } fclose($shandle); fseek($chandle, 0); if ($shandle = @fopen($cfgsession['file'], "cb")) { if (flock($shandle, LOCK_EX)) { ftruncate($shandle, 0); $cfgsession['count'] = 0; while (!feof($chandle)) { $cline = trim(fgets($chandle)); fputs($shandle, $cline . "\n"); $cfgsession['count']++; } } else $error = true; fclose($shandle); } else $error = true; } else $error = true; fclose($chandle); } else $error = true; if (($cfgsession['returning'] == false) && ($mysession == $cfgsession['session'])) { $cfgsession['returning'] = true; $mysession = md5(microtime()); } $cfgsession['session'] = $mysession; if ($error) return -1; else return 0; } function session_count() { global $cfgsession; return $cfgsession['count']; } function session_client() { global $cfgsession; return $cfgsession['client']; } function session_id() { global $cfgsession; return $cfgsession['session']; } function session_index() { global $cfgsession; $index_return = array(); if ($uhandle = @fopen($cfgsession['file'], "rb")) { flock($uhandle, LOCK_SH); while (!feof($uhandle)) { $uline = explode(" ", trim(fgets($uhandle)), 4); foreach ($uline as &$value) { if ($value[0] == "$") $value = substr($value, 1); } if (count($uline) >= 2) $index_return[] = $uline; } fclose($uhandle); } return $index_return; } function session_returning() { global $cfgsession; return $cfgsession['returning']; } ?>