Session problem during refresh.

Question

When i refresh my flex application, the page does not hold its state and gets back to login page. I am not sure why this occurs, Here is my peiece of code handling session.

public function doLogin($username,$password) {

  include("connection.php");
  session_start();
  session_register("session");


  $query = "SELECT *
                  FROM users
                  WHERE username = '".mysql_escape_string($username)."'
                  AND password = '".mysql_escape_string($password)."'";
  $result = mysql_fetch_array(mysql_query($query));
  if(!$result) {
  session_unset();
  return 'no';
  }
  else 
   {
  $session['id']=session_id();
  $session['username']=$username;
  return 'yes';
   }
  }

 public function Logout() { 

 session_start();
 session_register("session");
 session_unset();
 session_destroy();
 return 'logout';  
 }

Should i do something on my Flex pane which loads after a successful login.

Answer 1

After successful login redirect back to some other page.

For example

if(doLogin($user,$pass) == 'yes')
{
    Header("Location: index.php");
    exit;
}

Answer 2

By refresh do you mean reload the page (F5). If so then that is the reason! A reload/refresh will reinitialise everything. So whatever is your starting state (login) will be shown when you reload/refresh.

If you wish to maintain the apps state then every time the state changes you would have to save its details to a DB then when the user hits the starting page reload their session.

If the browser gets refreshed/reloaded (or crashes etc) then you have no means of getting the app to logout the user, so you'd have to revert to the last know state when the login page gets hit. This would of course have major security issues if the user didn't log of properly.

Answer 3

Are you maintaining the session id in your flex application, and sending it along with new requests?

Can you test & confirm that the same session id is being returned from your PHP scripts on each request inside Flex?

Are you persisting the session id in a cookie outside of your flex application? If not, you will lose your session id on page refresh. You'll need to store in local storage or in a cookie, and access this when your flex application starts.

Answer 4

your problem is here

   else 
                    {
            $session['id']=session_id();
            $session['username']=$username;
            return 'yes';
                    }
            }

$session is not defined... if you want to store something in the session array use $_SESSION