PHP Session Id changes between pages

Question

I have a problem where i am losing the PHP session between 2 pages.

The session_start() is included in a file called session-inc.php into every page requiring a session to be set. This works for all pages on the site except one particular page, member-profile.php. When this page is visited a new session with a different id (same session name) is set and used instead.

A few more details:

• Session name is set manually
• All pages are on the same server under the same domain name
• If i put an additional session_start() above the include('session-inc.php') in the member-profile.php file, the session is carried over correctly
• I have tried setting the session_cookie_domain and session.session_name in the .htaccess, this worked for this domain but it stopped the session being passed over to out payment domain
• We are running apache 2.2.6 with php 5.2.5

Putting the session_start() above the include('session-inc.php') in the member-profile.php file is the quick and dirty fix for this problem, but i am wondering if anybody know why this would be happening.

Cheers

Will

Answer 1

While migrating a legacy site from PHP4 to PHP5 I noticed a php.ini configuration setting that causes php to auto-start the session upon every request. It's an alternative to placing session_start() onto every page...

There are multiple ways to enable this setting:

Put the following line into php.ini:

session.auto_start = on

or put this into your apache virtual-site config or .htaccess file:

<IfModule mod_php5.c>
  php_flag session.auto_start on
</IfModule>

and it should make $_SESSION changes available across all pages

Answer 2

SOLUTION: session.auto_start = on in file: php.ini

It solved the issue of re-generating session id on page reload (page refresh / change pages).

The issue appeared after the update of CPanel (and included Multi PHP), even the php version remained the same.

The PHP.ini file didn't had that variable at all. Went in Cpanel -> MultiPHP INI Editor -> Editor Mode (not Basic, in basic you do not have this setting) and added the line. Press Save.

TIPS / WHEN TO USE THIS SOLUTION: To determine if that is the problem, put a line at the very beginning and at the very end of your index.php file to check the session id. Use function: session_id(); Navigate through pages / reload the page. If the session_id value changes the problem is not in your code and this solution should solve your problem (the session is lost outside of your code).

I also tried to verify the availability of saving session on the web server (session.save_path) but, even if it was a lead, it was not the case. I imagine this is a "feature" of Cpanel with MULTIPHP UPDATE that will happen quite often.

Answer 3

I have just encountered this problem. Interestingly, browsing via http://127.0.0.1 instead of http://localhost helped me.

Answer 4

According to PHP documentation, session_start must be called before any output is sent back to the browser-- could this page have a rogue CR/LF, Unicode byte-order mark or similar that is causing output before you include('session-inc.php')?