Storing Session data in $_COOKIE as well

shownomercy · 08-19-2008, 09:34 PM

I have been struggling for a while on how to share information stored in $_SESSION in order to avoid pop up issues with IE and etc. I would really like some insight into how to deal more gracefully with cookies, from someone who uses them more often than i.

Basically all I want to do is populate the session data into the cookie. Here is an example of code that would be nice to work:

PHP Code:


			
$userid = $_SESSION['userid'];

$username = $_SESSION['username'];

$password = $_SESSION['password'];

$userlevel = $_SESSION['userlevel'];



setcookie("uservars['userid']", $userid);    

setcookie("uservars['username']", $username);    

setcookie("uservars['password']", $password);    

setcookie("uservars['userlevel']", $userlevel);

For whatever reason, setting the cookies on the same script the session is being set from POST is not working properly either ... but I would be happy to employ another similar method.

The only cookie that is working is the one to identify the session ... erg

sjaq · 08-19-2008, 10:46 PM

You shouldn't do this, it's totally unsafe to store data from sessions in cookies. That's why there are sessions so you can store data the client shouldn't see.

shownomercy · 08-19-2008, 11:01 PM

Fair enough, although for this particular application, security is not a real issue.

The problem is that sessions aren't persistent through page loads due to having a load balanced server. There is also the issue of pop ups killing the session in IE. I am trying to work out a two birds, one stone approach ;(

Do you know of any workarounds for this that don't involve using cookies? I certainly prefer sessions all things equal. But I certainly can't be having a user authenticate on each new page ...

delayedinsanity · 08-20-2008, 01:05 AM

Never ever store their password in a public location. It's perfectly safe to store other session data in a cookie, so long as the authentication doesn't take place directly from the cookie to the application.

Just out of curiousity, what is this about popups in IE killing sessions?
-m

shownomercy · 08-20-2008, 02:19 PM

Thanks for all your input so far ... again security for this particular bit of code is not an issue, I just want to figure out why setting cookies isn't working ...

The IE issue is pretty well known, I run into it mostly when spawning pop ups (to input data etc.). There is a lot of information about it here.

delayedinsanity · 08-20-2008, 03:19 PM

Never heard of it till now, but as for your cookie problem, have you tried setting your own expiration on them? According to the manual;

If set to 0, or omitted, the cookie will expire at the end of the session (when the browser closes).

So perhaps you're running into a situation where the cookie is expiring before the browser is closing, for whatever reason. Try the following perhaps;

PHP Code:


			
setcookie("uservars['userid']", $userid, time()+60*60*24*14);     
setcookie("uservars['username']", $username, time()+60*60*24*14);     
setcookie("uservars['password']", $password, time()+60*60*24*14);     
setcookie("uservars['userlevel']", $userlevel, time()+60*60*24*14);

Which will set them to expire in two weeks time (you can change this to anything you wish).
-m

sketchMedia · 08-21-2008, 11:26 AM

Setting session variables then setting cookies with the data from the sessions breaks the whole concept of sessions and as people have said, potentially causes a security issue.

For a load balanced server setup you may be interested in using the DB to store session information with:
session_set_save_handler

That way the sessions are no longer stored on the server but in the DB (which should be central and available to all boxes) therefore they exist to all servers on the load balancer (in theory)

buggabill · 08-21-2008, 02:01 PM

@sketchMedia
I have been working on a login system here, and this will suit my needs well. I had never thought to look for something like it. I was coding my own solution, but this will make things a lot easier. Thanks!

sketchMedia · 08-21-2008, 03:00 PM

no probs m8, glad to help.