Why won't my cookie value change in PHP 5?

Question

Hi, I have a website where the login info is optionally saved in a cookie (remember me checkbox at login) and when the user logs out, the value of the authentication cookie won't change to expire the cookie allowing logout.

The system does work correctly in both the dev and staging servers but for some reason will not work on our production server. We are running PHP 5 and Apache on all the servers.

Thanks.

Function to set cookie (minor edits for security):

function setCookieInfo($data,$expiry=0)
{
   if($data === false)
   {
       //remove cookie!
       $cookie = false;
       $expiry = 100; //should be in the past enough!
   }
   else
   {
       $serial = base64_encode(serialize($data));
       $hash = md5($XXX);
       $cookie = $hash."---".$serial;
   }

   if($_SERVER['SERVER_NAME']=='localhost')
   {
       $domain = null;
   }
   else
   {
       $domain = '.'.$_SERVER['SERVER_NAME'];
   }

   return setcookie('Auth', $cookie, $expiry, $this->controller->base, $domain);
}

Answer 1

Posting some actual code might help, but I'll hazard a guess that it has something to do with the cookie domain being used.

Answer 2

Assuming you are using the PHP setcookie() function, make sure that the domain and path for the cookie are set correctly. Check PHP's documentation for the function for more information.

I might be able to tell you for sure if I had a little more info. Can you provide any more information without compromising too much about the project? How about the URLs of the dev, staging, and production servers, or at least examples of what they might be like?

Edit

Based upon the info you provided in your comment, I would recommend that you try using HTTP_HOST instead of SERVER_NAME. SERVER_NAME might be giving you a weird value depending upon your virtual server setup. Your path might not be quite right either - try a '/' and it should be available regardless of the subdirectory the user is in.

Also,

$this->controller->base

makes me think that you might be using CodeIgniter or Kohana. If so, you might consider using their cookie helpers.

Answer 3

Grab a traffic capture (e.g. www.fiddler2.com) of the SetCookie call that is intended to delete the cookie, and ensure that the Domain is valid and the expiration time/value is as expected.