Need to carry on browser "session" when calling another php script through CURL

Question

I have a "primary" PHP script (actually a set of scripts) all of whom the user interacts with through the browser. I've had no problems using the site as the session information works from page to page.

However, one of the scripts needs to directly call another "secondary" php script on my site using CURL and that "secondary" script needs to get information about the php session (which contains the currently logged in user, etc) from the "primary". I need to pass on the session information from the "primary" php script to the "secondary" one in CURL. Any suggestions on how I can do that?

No, I dont want to use cookies here (too insecure).

Answer 1

I know you said you don't want to use cookies because they're insecure. In the following solution, the client side session cookie is "forwarded" on to a second request. Forwarding a cookie to the local machine should create no security disadvantages.

You can pass the session cookie from the client browser to the new, server-side request (thanks to Ben for pointing out session_name).

$curl_cookies = session_name() . '=' . session_id() . '; path=/';
curl_setopt($ch, CURLOPT_COOKIE, $curl_cookies);

For simplicity, I'm only passing in the PHPSESSID cookie (I'm also assuming it is your session's cookie key).

Answer 2

PHP sessions are almost by definition tied to a cookie (though can also be passed as a request parameter). So forwarding the session ID cookie might be the best way to go, assuming both scripts are on the same PHP install.

You can use session_name() to get the session name/cookie name, which is by default PHPSESSID like Brian points out.

Answer 3

why not just send an http query string parameter with the session id in it?

for instance (in pseudocode):

curl.send('http://myserver.com/myapplication.php?session%5Fid=' . getSessionId());