Problem to using session in different subdomain

Question

I need to use the same session in different subdomains.

First I put

php_value session.cookie_domain ".aaaa.com"

on .htaccess file and upload it to root path.

when I need to use sessions. I just call

session_start();

Sometimes it works but sometimes it doesn't.

I tested this and found that.

1. If I go to login page the first time, then login and go to subdomain page. It works!

2. If I go to subdomain page and click to login page and go back to subdomain page by javascript window.location = 'http://sub.aaaa.com'; it does not work!!

3. If I login on 2 web browser with the same account it does not work!!

Are there another way? Or how do I fix this problem. I want my website to use a single login.

Answer 1

1. Make sure you have session_start() on every page you are using sessions, including some that might not be visible to the user.

2. If you are using two web browsers the sessions are independent from each other, and this is by design.

Answer 2

I have some question.

If I have an index.php file and in this file i use.

include_once('subpage.php');

so I have session_start(); in index.php

how about subpage.php it can use $_SESSION['id']; or not?

Answer 3

To debug your #2 problem, use an HTTP monitor such as HTTPFox to view the headers coming to/from the server as you log in and surf around, make sure the cookie is being properly set with the correct domain and path restrictions.

Probm #3 - I'm not sure what you're getting at. Are you using two seperate browsers (say Firefox and Chrome?), or do you mean you're using two windows/tabs of the same browser? For the first, two different browsers will not share cookies, so you can't share a single session between them, without doing some hacks to manually transfer cookies between them.

As for two different tabs/windows of the same browser, such an implementation depends on your login logic. If the login script starts a new session unconditionally, then you second login attempt will get a completely seperate session from the first login, and most likely overwrite the first login's cookie as well.