sending session cookie before redirect

[Jochen Daum]

Hi!

I have a function in a lot of pages, which redirects to a new page, if
a form has been submitted:

if (!(defined("DEB UG_INSERT") && DEBUG_INSERT) &&
!(defined("DEBU G_UPDATE") && DEBUG_UPDATE) &&
!(defined("DEBU G_SELECT") && DEBUG_SELECT)){
if ($_POST){
$_SESSION["postvalue"] = $_POST;
header("HTTP/1.1 302 Moved Temporarily");
header ("Location: ".BASE_URL.$ses s->assemble(),tru e, 302);
header("Connect ion: close");
exit();
}else{
if (isset($_SESSIO N["postvalue"])){
$_POST = $_SESSION["postvalue"];
}
}
}

In conjunction with a login form and a browser that accepts cookies
for the session handling, this leads to everyone having to enter his
login and pasword twice.

i believe this is, because the cookie do not get sent before the
header ("Location:
Has anyone an idea how to force this or send them by hand?

Cheers, Jochen
--
Jochen Daum - CANS Ltd.
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.
http://sourceforge.net/projects/phpdbedittk/

[Gary Petersen]

A Martian named "Jochen Daum" <jo*********@ca ns.co.nz> telepathically
imparted message <pn************ *************** *****@4ax.com> to us on
Thu, 04 Sep 2003 23:57:35 -0500:

Hi!

I have a function in a lot of pages, which redirects to a new page, if a
form has been submitted:

if (!(defined("DEB UG_INSERT") && DEBUG_INSERT) &&
!(defined("DEBU G_UPDATE") && DEBUG_UPDATE) &&
!(defined("DEBU G_SELECT") && DEBUG_SELECT)){
if ($_POST){
$_SESSION["postvalue"] = $_POST;
header("HTTP/1.1 302 Moved Temporarily");
header ("Location: ".BASE_URL.$ses s->assemble(),tru e, 302);
header("Connect ion: close");
exit();
}else{
if (isset($_SESSIO N["postvalue"])){
$_POST = $_SESSION["postvalue"];
}
}
}
}
In conjunction with a login form and a browser that accepts cookies for
the session handling, this leads to everyone having to enter his login
and pasword twice.

i believe this is, because the cookie do not get sent before the header
("Location:
Has anyone an idea how to force this or send them by hand?

Cheers, Jochen

Keep it simple:

session_start() ;
if (!isset($_SESSI ON['postvalue'])):
header ("HTTP/1.1 302 Moved Temporarily to Singapore");
header ("Location: http://myhost.com/login.php");
exit();
endif;
$_POST = $_SESSION['postvalue'];
// show the page
BTW, is there any reason that you just *have* to
use $_POST for all the pages? $_POST is only needed to
retrieve the variables from the (login?) form. After that,
you are free to do everything in $_SESSION['postvalue'].

The "to Singapore" part is just a jest. Don't include it :D

[Jochen Daum]

HI Gary!

On Sun, 07 Sep 2003 09:31:51 GMT, Gary Petersen
<ga*******@REMO VE.MEearthlink. INVALID> wrote:

A Martian named "Jochen Daum" <jo*********@ca ns.co.nz> telepathically
imparted message <pn************ *************** *****@4ax.com> to us on
Thu, 04 Sep 2003 23:57:35 -0500:

Hi!

I have a function in a lot of pages, which redirects to a new page, if a
form has been submitted:

if (!(defined("DEB UG_INSERT") && DEBUG_INSERT) &&
!(defined("DEBU G_UPDATE") && DEBUG_UPDATE) &&
!(defined("DEBU G_SELECT") && DEBUG_SELECT)){
if ($_POST){
$_SESSION["postvalue"] = $_POST;
header("HTTP/1.1 302 Moved Temporarily");
header ("Location: ".BASE_URL.$ses s->assemble(),tru e, 302);
header("Connect ion: close");
exit();
}else{
if (isset($_SESSIO N["postvalue"])){
$_POST = $_SESSION["postvalue"];
}
}
}
}
In conjunction with a login form and a browser that accepts cookies for
the session handling, this leads to everyone having to enter his login
and pasword twice.

i believe this is, because the cookie do not get sent before the header
("Location:
Has anyone an idea how to force this or send them by hand?

Cheers, Jochen
Keep it simple:

session_start( );
if (!isset($_SESSI ON['postvalue'])):
header ("HTTP/1.1 302 Moved Temporarily to Singapore");
header ("Location: http://myhost.com/login.php");
exit();
endif;
$_POST = $_SESSION['postvalue'];
// show the page

How does the value of all form fields get into $_SESSION?
BTW, is there any reason that you just *have* to
use $_POST for all the pages? $_POST is only needed to
retrieve the variables from the (login?) form.

No. I have eg. a form on nearly every page to change filters of the
data displayed etc.

Jochen
--
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.
http://sourceforge.net/projects/phpdbedittk/

[Gerhard Fiedler]

On Sun, 07 Sep 2003 21:56:31 +1200, Jochen Daum wrote:

How does the value of all form fields get into $_SESSION?

you have to put it there, by simple assignment:

$_SESSION['parameter'] = $_POST['parameter'];

or something to that effect.

[Jochen Daum]

Hi Gerhard!

On Sun, 07 Sep 2003 12:16:26 -0700, Gerhard Fiedler
<no****@globo.c om.REMOVE> wrote:

On Sun, 07 Sep 2003 21:56:31 +1200, Jochen Daum wrote:

How does the value of all form fields get into $_SESSION?

you have to put it there, by simple assignment:

$_SESSION['parameter'] = $_POST['parameter'];

Well, I understand that. That's why I had it there in the original
post.

Any suggestions for my orginal problem?

Jochen
--
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.
http://sourceforge.net/projects/phpdbedittk/

[Gary Petersen]

A horsie named Jochen Daum demonstrated surprising intellligence and
its ability to use morse code on Sun, 07 Sep 2003 04:56:31 -0500 when
it tapped <9u************ *************** *****@4ax.com> with its hoof:

HI Gary!

Hi Jochen!
On Sun, 07 Sep 2003 09:31:51 GMT, Gary Petersen
<ga*******@REMO VE.MEearthlink. INVALID> wrote:

[...]
Keep it simple:

session_start ();
if (!isset($_SESSI ON['postvalue'])):
header ("HTTP/1.1 302 Moved Temporarily to Singapore");
header ("Location: http://myhost.com/login.php");
exit();
endif;
$_POST = $_SESSION['postvalue'];
// show the page

How does the value of all form fields get into $_SESSION?

The login.php page should present a username/password form
to the user. When the user submits the form, the form's data
would go to a process_login.p hp page. If the username and
password are correct, process_login.p hp would put all of
the necessary data into $_SESSION['postvalue']. The password
does not need to be stored in the session.

BTW, is there any reason that you just *have* to
use $_POST for all the pages? $_POST is only needed to
retrieve the variables from the (login?) form.

No. I have eg. a form on nearly every page to change filters of the
data displayed etc.

To make my life easier, I would do this:
if (isset($_POST['somevariable'])) {
$_SESSION['displayform'] = $_POST;
$disp = & $_SESSION['displayform'];
}

Then I would use $disp for everything on the page.
"Somevariab le" is just any variable that you can use
to make sure that the form variables are there.
Good luck.

PS.
Unless you are running on a dedicated server, sessions
are not all that secure.

[Gerhard Fiedler]

On Mon, 08 Sep 2003 07:41:24 +1200, Jochen Daum wrote:

Well, I understand that. That's why I had it there in the original
post.
I only looked at the post I answered to... :-/
Any suggestions for my orginal problem?

It seems Gary answered. But for more, I guess some more code would be
necessary. At first sight (without actually testing it) there seems
nothing wrong with your code.

You say that you do something with cookies -- but there's no cookie
code in what you posted. You can look at the cookie (at the client),
and you can also look at the headers that get exchanged (use something
like Proxomitron) to make sure they do what you want them to do.

You can also dump your postvalue and _POST arrays at various points to
make sure they contain what you expect them to contain. That should
get you closer to the point where things start to diverge from what
you think they should do.

[Jochen Daum]

Hi Gary!

....

[...]
Keep it simple:

session_star t();
if (!isset($_SESSI ON['postvalue'])):
header ("HTTP/1.1 302 Moved Temporarily to Singapore");
header ("Location: http://myhost.com/login.php");
exit();
endif;
$_POST = $_SESSION['postvalue'];
// show the page

How does the value of all form fields get into $_SESSION?

The login.php page should present a username/password form
to the user. When the user submits the form, the form's data
would go to a process_login.p hp page. If the username and
password are correct, process_login.p hp would put all of
the necessary data into $_SESSION['postvalue']. The password
does not need to be stored in the session.

Sorry, you misunderstand the problem slighly. The data stored in
postvalue is not the data from the login form, but from another form.
It should actually be all form data, that is sent by post in a whole
application (meaning a set of web pages). The problem is, that if I
run the function above (my original one) everytime there is a post
form (including the login), then the user gets prompted twice for the
password/username. This is IMO, because the cookie with the PHPSESSID
is not sent to the client browser, before the header ("Location" line.
I think it is like that, because
1.) it works fine, if I exclude the login form from the ones handled
by this function
2.) it works with browser denying all cookies.

BTW, is there any reason that you just *have* to
use $_POST for all the pages? $_POST is only needed to
retrieve the variables from the (login?) form.

No. I have eg. a form on nearly every page to change filters of the
data displayed etc.

To make my life easier, I would do this:
if (isset($_POST['somevariable'])) {
$_SESSION['displayform'] = $_POST;
$disp = & $_SESSION['displayform'];
}

Then I would use $disp for everything on the page.
"Somevariabl e" is just any variable that you can use
to make sure that the form variables are there.

I though of marking the login form with a hidden field, so that I can
recognise it, but I actually want the functionality also for the login
form. Its basically about usability against speed. The users don't
understand, what they have to do, if the browser asks them if they
want to resubmit the data. Thats why I redirect them to a GET request
everytime, so that the message doesn't come up.
PS.
Unless you are running on a dedicated server, sessions
are not all that secure.

I do.

Jochen

--
Jochen Daum - CANS Ltd.
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.
http://sourceforge.net/projects/phpdbedittk/

[Jochen Daum]

Hi Gerhard,

Any suggestions for my orginal problem?
It seems Gary answered. But for more, I guess some more code would be
necessary. At first sight (without actually testing it) there seems
nothing wrong with your code.

You say that you do something with cookies -- but there's no cookie
code in what you posted. You can look at the cookie (at the client),
and you can also look at the headers that get exchanged (use something
like Proxomitron) to make sure they do what you want them to do.

When you use PHP sessions, a unique ID is transported to the browser
by a cookie, if the browser accepts it. AFAIK on the first request
there is always a cookie sent, and if it wasn't there and a session
has been started with the SID parameter in the URL none gets sent.

This is the cookie I'm talking about. My original problem is, that if
I run the original function on all pages, the user gets prompted twice
for username/password. This is IMO, because this cookie (for
successful login) is not sent through before the header command.
You can also dump your postvalue and _POST arrays at various points to
make sure they contain what you expect them to contain. That should
get you closer to the point where things start to diverge from what
you think they should do.

They seem to look fine. I'll have a closer look soon.

Jochen
--
Jochen Daum - CANS Ltd.
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.
http://sourceforge.net/projects/phpdbedittk/

[Gary Petersen]

A horsie named Jochen Daum demonstrated surprising intellligence and its
ability to use morse code on Sun, 07 Sep 2003 23:35:14 -0500 when it
tapped <o1************ *************** *****@4ax.com> with its hoof:

Hi Gary!
Hi Jochen!
[...] everytime there is a post form
(including the login), then the user gets prompted twice for the
password/username. This is IMO, because the cookie with the PHPSESSID is
not sent to the client browser, before the header ("Location" line. I
think it is like that, because
1.) it works fine, if I exclude the login form from the ones handled by
this function
2.) it works with browser denying all cookies.
[...]

Maybe you are not starting the session early enough on one
of your pages.

The session has to exist *before* the login process starts,
so if you have a login.php page that presents a login form to
the user, make sure that it starts the
session with session_start() -- right at the top of the page--
before the user gets to do anything (even log in). And then each
page in the system does the same, starting the session as
the first thing.

Separate the concept of a session from the concept of an
authenticated user. It's possible to have a session where
the user is un-authenticated, and it's possible to have a
session where the user is authenticated.