PHP SESSION data lost between page loads with WAMPserver 2.0 on localhost

Question

I have a PHP authentication system on my website using the $_SESSION variable.

A form submits a username and password to the file \"login.php\". It is handled like t

Answer 1

Update to WAMP 2.5 and now the problem is solved!

Answer 2

I had this problem using WAMPSERVER for development on /localhost. I needed to change session.use_only_cookies either in-line or in the php.ini setting from

session.use_only_cookies = 1

to

session.use_only_cookies = 0

Explanation

Using default cookie-based sessions was working as expected but I needed a cookie-less solution. A test starting page:

<?php
// page1.php

ini_set('session.use_cookies', '0');
session_start();

$_SESSION['time'] = time();

echo '<br /><a href="page2.php?' . SID . '">page 2</a>';
?>

The session data was created and stored successfully in the WAMPSERVER temp directory, e.g., C:\wamp\tmp\sess_0rkdlonl5uia717rf03d4svs16. The link generated by the above code looks similar to (note the UID matches the session data file name):

page2.php?PHPSESSID=0rkdlonl5uia717rf03d4svs16

But the destination page2.php was throwing undefined errors for the variable 'time' whilst attempting to retrieve the session data:

<?php
// page2.php

ini_set('session.use_cookies', '0');
session_start();

echo date('Y m d H:i:s', $_SESSION['time']);

echo '<br /><a href="page1.php?' . SID . '">page 1</a>';
?>

By setting session.use_only_cookies FALSE in either the script before session_start();:

ini_set('session.use_only_cookies', '0');

or changing it globally in php.ini:

; This option forces PHP to fetch and use a cookie for storing and maintaining
; the session id. We encourage this operation as it's very helpful in combatting
; session hijacking when not specifying and managing your own session id. It is
; not the end all be all of session hijacking defense, but it's a good start.
; http://php.net/session.use-only-cookies
session.use_only_cookies = 0

solved the problem.

Answer 3

After a long time I have fixed this bug finally.

On my localhost WAMP, the session data is not saved between page loads, because the session data is stored in a cookie, and there is no cookie domain to be set for localhost.

The solution:

'session.cookie_domain' should be set to empty string for all local domain names, not only for 'localhost' (but should not be empty for local IP addresses):

<?php
ini_set('session.cookie_domain', (strpos($_SERVER['HTTP_HOST'],'.') !== false) ? $_SERVER['HTTP_HOST'] : '');
?>

Thanks to Marcin Wiazowski who posted it here.

Answer 4

Try to replace

if($_POST){...}

with

if( isset($_POST['username']) && isset($_POST['password']) ){...}

... at least for debugging purposes. It's possible that some different settings are causing a non-empty $_POST array where it's not expected.

Also, your code seems to be missing exit() calls after header() redirections. Sending an HTTP Location header doesn't automatically stop your script.

Answer 5

First of all: the index logedin seems strange for keeping track of a user being logged in. Is this just a typo on SO, or really a code-typo?

Second (depending on the desired behavior), try another approach for making pages login-protected. Your page should look something like

<?php
  include 'login.inc.php';

  if(authorized()) {
    // put some more script here, if needed
    ?>
    // put some plain HTML here  
    <?php
  }
?>

Where login.inc.php handles the session, cookies. In particular, the authorized function should return TRUE if a client is already logged in. If a client is not logged in, it should display a form with action $_SERVER['PHP_SELF'] and return FALSE. If you name the submit-input something like login_submit, you can let login.inc.php handle the verification.

This way, you don't need to refer users to a dedicated login page, and after logging in, user are directly shown the requested page. You can tweak this a bit to make query-strings persistent through login as well.

Answer 6

Faced the same problem but it was being caused by

session_regenerate_id(true);

So I just deleted it from my code.