Flash uploader has its own session id..... why?

Question

Im breaking my head against the table right now. I have a flash batch uploader, which puts every file through upload.php which thumbnails the images, and moves them to appropriate directories. When I upload in IE, it functions perfectly (never thought I'd say this), but in Firefox, when flash executes upload.php it has its own session variable, thats different from the one that is used to browse the rest of the site, so a logged in user is no longer logged in, so their userid isnt read nor inserted into the DB, and ever a simple piece of code like this:

$_SESSION["uploaded_ids"][] = $inserted_id;

Overwrites the entire array with just the last ID, since it cannot read it to append it.

What can I do? the uploader in question is this:

MultiPowUpload

Answer 1

If the php file is being executed via some form of ajax, and not directly from the browser, I believe the session is not persistant. IICRC Firefox treats ajax calls as new browser sessions.

If this sounds like it could be the case, I usually fix these problems by manually attaching the PHPSESSID to the end of the ajax call. Hopefully this helps.

Answer 2

Flash connections act as separate browsers, flash doesn't have direct access to your cookies so it usually can't send phpsessid. (unless it bypasses this with JS calls)

But MultiPowUpload says they fixed this in v2.0 so as long as you're using v2.0 and not configuring sendBrowserCookie=false it should work.

Our team solved this by generating a token into $_SESSION when the page is created. This token is then added to the upload url and php associates the file with this token in xcache. Then an oncomplete ajax function calls the php with the correct phpsessid and token to pair them.

Answer 3

Flash DOES have access to your cookies normally, but FileReference is a strange exception in MSIE, and as you've obviously noticed will not send the current session cookie.

I have got around this problem by passing the session id into flash (either with flashvars, or a separate remote service) then passing the session id in the query string when you post the FileReference upload. You can then start the session in PHP with the forced id.

Answer 4

If you want to encourage Adobe to fix this bug, here is a bug-tracker link for this issue:

https://bugs.adobe.com/jira/browse/FP-1044

Unfortunately you have to create an account to view the issues, but there they are anyway.

There are 3 other links, but stack overflow is preventing me from posting them because my reputation is too low.