Resuming session with an AJAX call

Question

My app has a session timeout after 30 minutes. If the user has a "permanent login" feature activated, then on a subsequent HTTP request the server reads the "perm session" cookie and restores the session.

However, if the user does not reload or navigate to another page after his session expired, but rather clicks on a button that retrieves data via AJAX, the session is not resumed; in the DIV where the data was supposed to be loaded into, a login window appears instead.

This leads me to an assumption that AJAX calls do not carry cookie information with them. Am I correct, or have I missed something else?

Update:

backend: symfony 1.2 (PHP framework), frontend: Prototype

Update2: it was a bug in the application, not an issue with cookies

Answer 1

An XMLHttpRequest call should carry cookie information like normal. You may be running into a bug. Are you ensuring the call is from the same domain origin?

Perhaps your cookies are also expiring? More info might help .. :)

Answer 2

Sounds like you are restoring the session, but not providing a new auth cookie. You might want to try a technique that I've written about on my blog of having a client-side timer that will prompt the user right before the session times out and, when they click OK to renew it, will make a request that will serve to keep the session and authentication cookie alive. You can find more info at http://farm-fresh-code.blogspt.com. The article is titled Client-side Session Termination.