Maintaining session variables by subdomain

Question

I tried to maintain session vars between two subdomains and found this impossible. I ended up creating 2 minimal PHP web pages as a test bed, which I call "test 1", just sets

$_SESSION['test'] = "Fred"; 

and has a hyperlink to 'test 2', which just tries to display the value of $ _SESSION ['test'] to prove that it worked or not. I put 'test 1' in my www domain and 'test 2' in my subdomain. I am trying a different version of what should be in the header from different sources. Here are the main 3 (and, of course, their options):

 ini_set('session.cookie_domain',substr($_SERVER['SERVER_NAME'],strpos($_SERVER['SERVER_NAME'],"."),100)); session_start(); 

or

 ini_set('session.cookie_domain','mydomain.com'); session_start(); 

or

 ini_set('session.cookie_domain', PHP_INI_ALL); session_start(); 

or

 session_set_cookie_params(0, "/", ".mydomain.com", false); session_start(); 

I find that I get the same result in every case. The session is not migrated through subdomains, and page 2 verification has no idea what value I set $ _SESSION ['test']. Nevertheless, there seems to be a lot of certainty that one of the above methods should work. Any idea what might happen, especially since I use minimal pages to test the mechanism (no side effects that I can see)? By the way, I'm on a shared server if this pertinant is here.

Thanks for your thoughts. Franc.

Edit I fixed it. The problem was caused by Sukhosin. See the detailed answer at the end of this page.

Answer 1

Ok, I nailed him and he was rude.

The suhosin suhosin.session.cryptdocroot option was the whole cause of the problem. When the session encryption key is based on DocRoot, it causes the subdomains to not see session variables when the base domain and subdomains are served from different directories. This leads to the fact that the session vars on the server are stored in different folders and, therefore, they are not visible for each of the corresponding domains.

Decision. Just add these 2 lines to your php.ini file:

 suhosin.session.cryptdocroot=Off suhosin.cookie.cryptdocroot=Off 

48 hour tracking nightmare, 4.8 seconds to fix.

Answer 2

I have a job setting up the session name and session cookie options:

 $some_name = session_name("some_name"); session_set_cookie_params(0, '/', '.some_domain.com'); session_start();