PHP Session Id changes between pages

Question

I have a problem where i am losing the PHP session between 2 pages.

The session_start() is included in a file called session-inc.php into every page requiring a sess

Answer 1

I had this problem, and the cause was that PHP was ignoring all cookies after the first 100. (I asked this question to try to find out why, but so far nobody has figured it out). The browser was sending the PHPSESSID*, but since it was the 110th cookie, PHP was ignoring it.

To figure out if this problem is what's affecting you, use your browser's dev tools to look at the cookies that the browser is sending with the request, and compare that list to the $_COOKIE array in PHP. They should be the same. But if the browser is sending a PHPSESSID*, and there's no PHPSESSID* in $_COOKIE, then that would explain why sessions aren't working.

I solved the problem by not having my site use so many cookies, which is good practice anyway.

*PHPSESSID is the default session name. Your site may use a different name.

Answer 2

According to PHP documentation, session_start must be called before any output is sent back to the browser-- could this page have a rogue CR/LF, Unicode byte-order mark or similar that is causing output before you include('session-inc.php')?

Answer 3

While migrating a legacy site from PHP4 to PHP5 I noticed a php.ini configuration setting that causes php to auto-start the session upon every request. It's an alternative to placing session_start() onto every page...

There are multiple ways to enable this setting:

Put the following line into php.ini:

session.auto_start = on

or put this into your apache virtual-site config or .htaccess file:

<IfModule mod_php5.c>
  php_flag session.auto_start on
</IfModule>

and it should make $_SESSION changes available across all pages

Answer 4

To solve the session_id change after each request, you change the parameter session.auto_start and session.cookie_httponly into the php configuration file.

to find the used php configuration file

php -i | grep "php.ini"

then you open it, and try to find the parameter session.auto_start . you set

session.auto_start = 1
session.cookie_httponly = 0

finally you restart your httpd/apache service.