Force php to pass the SID in url - even if cookies are accepted in the browser

Question

I'm trying to get php to automatically pass the session ID via url, even if the browser accepts cookies.

I know url session id are normally considered a security risk, but I have a very specific application in mind which requires several separate users to be able to log in to the same php session, despite what cookie settings their browsers have. Sharing the url is my aim here, rather than a threat.

There will be several "groups" of users, each group should have a unique shared session, so simply applying a fixed session id in the code won't work. I want the "owner" of the group to be able to initiate the session, get a unique id, then pass this on to all the other users, via a url.

As it's an existing application, I can't make modifications that will affect the normal session behaviour for other users - this is for users in a specific group of IPs - which is why i'm trying to modify the standard session handling.

I've tried using ini_set() to disable session.use_cookie, but that simply prevents the session from being remembered at all.

Any suggestions gratefully received.

Answer 1

Have you try enabling session.use_trans_sid ?

Answer 2

Set

session.use_cookies=0
session.use_trans_sid=1

via ini_set() or in the php.ini, .htaccess ...or where ever you can change the configuration settings.
see also:

• http://docs.php.net/session.configuration#ini.session.use-cookies
• http://docs.php.net/session.configuration#ini.url-rewriter.tags