PHP login session wont work on first page load in a NEW window with no cache

问题

I am working on creating a website from scratch and am currently stuck with session stuff.. I know generally how sessions work and how to store things into $_SESSION after session_start() but my main problem is this. After clearing the cache and opening a new window, submitting a login request the FIRST time wont submit correctly and the page reloads and nothing has changed, but AFTER the first time, it works fine... my login.php handles either a) the post request, or b) the login via url (for testing purposes) so a link to "user/login.php?username=facebook&method=get" would be sent to the code below and set the user to logged in with the name facebook..

<?php
session_start();
$method = $_GET['method'];
if($method == "get") $_SESSION['username'] = $_GET['username'];
else $_SESSION['username'] = $_POST['username'];
header('Location: http://www.imggroups.com');
?>

Im not sure if this matters, but, on the index page, I check to see if the user is logged in by doing this. starting session obviously, then doing. if(isset($_SESSION['username'])) echo whatever i need for logged in.. else echo whatever for not logged in.....

回答1:

The issue is that you are redirecting the user to a new page, but the old page has not finished closing, so the session is not yet saved.

In order to fix this I usually setup an interum page which redirects to the correct page.

Alternatively you might be able to use session_write_close() (http://www.php.net/manual/en/function.session-write-close.php) before using the header redirect

回答2:

The fact of the matter is, it is setting the session, BUT it's redirecting you to a different domain that the session isn't allowed on. If you access the website without the 'www.' in front then get redirected to the www version afterwards, then it's going to say your session doesn't exist. Use the following:

session_set_cookie_params(0, '/', ".imggroups.com");

Put it before your session_start() and it will work for both www and non-www versions of your site.

回答3:

If that is the total of the login.php, I believe there is easier ways to do that:

If it does not matter whether the username actually comes in via _GET or _POST, then use _REQUEST as it encapsulates both.
```
if( isset($_POST['username'] ) {
    $_SESSION['username'] = $_REQUEST['username'];
}
```

If it does matter, you don't have to trust or use an external parameter, just look at what's there:

if( isset($_POST['username'] ) {
    $_SESSION['username'] = $_POST['username'];
} else if( isset($_GET['username'] ) {
    $_SESSION['username'] = $_GET['username'];
} else {
    // whinge
}

I've not run into that issue with PHP before, but you can also do a session_write_close(); to force it to write out the session before it redirects to the other page.

来源：https://stackoverflow.com/questions/7169340/php-login-session-wont-work-on-first-page-load-in-a-new-window-with-no-cache

标签

php

session

global