Zend_Session lost when using regenerateId()

Question

I've had this problem in a couple of ZF applications now and it's very frustrating:

Near the top of my bootstrap I have the following two lines

Zend_Session::start();
Zend_Session::regenerateId();

My application requires authentication using Zend_Auth and uses default session storage for persisting an identity. At random the session is lost giving the effect that the user has logged out. If I remove the call to Zend_Session::regenerateId() the session is not lost.

Regenerating the session id increases security so I'd like to get this working. This problem occurs on both my local development server (windows) and our staging server (linux)

Answer 1

Hi dcaunt,

After reading your question i have been looking for a solution to your problem. Actually according to Zend Framework: Documentation the solution is quiet easy.

"If a user has successfully logged into your website, use rememberMe() instead of regenerateId()."

I hope this will help you out.

Greetings,

Younes

[edit: this is the link of where i found this: Zend Framework: Documentation

Answer 2

Hey David,

I've had a related problem with Zend_Session. Your session might have gotten lost due to the following problem:

try using this:

Zend_Session::rememberMe(100); // any value here

Then go to any of your pages in the application with your session data set (user logged in for example) and click on the refresh button of the browser very quickly (like double clicking) for 3-5 times. You'll see that your session data has disappeared :(

The only way I could deal with this is by not using the rememberMe() method for now. I hope somebody will shed light on this issue here. What I think is that the regenerateId() method somehow messes up the cookie value so that subsequent calls from the browser to the server do not get associated with an existing session id.