views:

236

answers:

2

Is it possible to use session cookies across browser sessions (specifically Internet Explorer). I would like a user to log in to my site and therefore get a cookie and when the user opens another IE process have that session cookie authenticate the user.

At the moment it is find if the user opens a new window or tab as this resides in the same process.

A: 

Session cookies expires as soon as the browser is closed (this is the default behavior with PHP session cookies at least). In Firefox, starting two processes with share both sessions on your site; with IE, it won't, probably because "session" cookies aren't shared between processes. To overcome this, you could handle your own session ID in a cookie that doesn't have 0 as expire time but a timestamp in the future (let's say 30 days ahead). This way, the cookie might survive between processes but you'll have to rely on your own ID to handle session information.

JP
A: 

So you actually want something like "Remember me on this computer" feature? Then you need to create another cookie yourself with a long lifetime, e.g. one year. In this cookie with a specific and predefinied name you should set a long, all-time unique, hard-to-guess autogenerated string (like a hash). You store the same value in the server side in a database table as PK, along with the user ID (and if necessary also user IP as optional security and the cookie TTL for automatic cleanup). Now, on every request check if the cookie is there and then do the automatic login thing with the user ID associated with the cookie value in the DB table.

BalusC