Force session ID from request

Question

Does anyone have any thoughts about why this wouldn't work?

    if(isset($_POST['PHPSESSID'])) {
session_id($_POST['PHPSESSID']);
session_start();
var_dump($_SESSION);
}

The var_dump($_SESSION); is always empty! It should be loaded with stuff! Are there any settings that prevent forcing session IDs? Auto start is not enabled.

Answer 1

The code you posted is correct. However, you may not be seeing variables in your session for one of several reasons:

• $_POST['PHPSESSID'] is not set
• $_POST['PHPSESSID'] contains non-numeric characters
• $_POST['PHPSESSID'] does not refer to a populated session ID
• session_start() was called before your call to session_id

If none of these apply, I don't know what the issue is, but why don't you try using session_name() (which was designed for what you're trying to do) instead of session_id?

Answer 2

Your $_POST['PHPSESSID'] must be wrong :

Depending on the session handler, not all characters are allowed within the session id. For example, the file session handler only allows characters in the range a-z A-Z 0-9 , (comma) and - (minus)

Check its value. If you changed the session handler, you must use only the allowed characters for this specific session handler.

---

Resources :

• php.net - sessionid()

Answer 3

There was an issue with the session save path. It wasn't set up right, so I can guess that PHP was relying on browser cookies to create the session instead of the files in the session save path.