How can I send PHPSESSID in the URL?

Question

I'm trying to send the PHPSESSID via a HTTP GET variable for a cookie-less client.

I've seen this in various drupal implementations where ?PHPSESSIONID=123ABC is appending to each link, but how do I specify this in PHP and is there any way of changing the GET parameter so it could be ?token=123ABC, or even sent via HTTP POST?

Standard LAMP stack, running the Zend framework.

Thanks!

Answer 1

1. Create a login page, the user must not login without correct id and password.
2. After logging in the user comes to the home, here user can logout and goes back to the login page.
3. User must not access home page without going through the login page.

Answer 2

Doing it manually:

if ($_REQUEST['token'])
  session_id($_REQUEST['token']);
session_start();

print("foo=".$_SESSION['foo']++."<br />".
      "<a href={$PHP_SELF}?token=".session_id().">link</a><br />");
print("<form method=POST>".
      "<input type=hidden name=token value=".session_id()." />".
      "<input type=submit /></form>");

Answer 3

You can change PHPSESSID using session_name() or session.name in your php.ini file (or using ini_set()).

For cookieless clients, there's the session.use_trans_sid php.ini option - you should be aware that this can cause problems - for example users passing URLs with session IDs in to each other, or search engines picking up such URLs.

Answer 4

Using a cookie or not is configured by these PHP options :

• session.use_cookies
• session.use_only_cookies

If the first one is set, cookies will be used if possible.
PHP should detect if cookies are enabled or not, and use them only if they are supported by the client.

To enable passing of the session id by GET instead of cookies, you might have to activate session.use_trans_sid, which is disabled by default (Which means that, by defaut, session id is only passed by cookies -- never by GET).

But note that, with this option activated, PHP will pass the session id by GET at least for the first page each user of your site will come to... as they won't have the cookie at first, and the only way to check if they support cookies is by setting one, and trying to read it back on the next page.
And users that don't support cookies, including search engines I'd probably say, will have that session id -- and that is not nice :-(

And, you might also want to take a look at session.name to set the name of the key (set to to "token" instead of "PHPSESSID", I mean)

For more details, you can take a look at the Session Handling section of the manual :-)