session.cookie_domain problem

From: Dustin Machi (dmachi_at_vt.edu)
Date: 11/21/03 

To: php-general@lists.php.net
Date: 21 Nov 2003 14:09:43 -0500

I have a small application that uses adodb and session for user
management. The sessions are managed through the use of
adodb-session-clob.inc.php. The code snippet below shows what I do
related to sessions (minuse some variable assignment). $cookie_domain
is set to '.whatever.com' However, when I try to assign a cookie domain
neither mozilla or ie will accept the cookie as I would expect they
should. Konqueror on the other hand does accept it just fine. If I
comment out that line, the cookie is properly established by all
browsers, but only for that one particular host instead of for the
domain. I have searched around for this for a few days in the mailing
lists and bug db, but haven't really found a solution. I did see a
message from one other person about this quite some time ago, but there
was never a response to that person's inquiry. Does anyone have any
idea what I am doing wrong, or is this a known issue

Thanks, Dustin

// Set session parameters and start session
ini_set("session.gc_maxlifetime", "172800");
ini_set( "session.entropy_file","/dev/random");
ini_set( "session.entropy_length","512");
ini_set( "session.name",$session_name);
ini_set( "session.cookie_domain", $cookie_domain);
session_start();

Relevant Pages

  • Re: [Full-disclosure] [WEB SECURITY] Preventing Cross-site Request Forgeries
    ... creating another layer of state management on top of the HTTP ... addition to the usual session state. ... solutions for workflow and pageflow. ... Additional levels of state management like these allow developers to ...
    (Full-Disclosure)
  • Re: asp.net web farm configuration - (cookie domains?)
    ... authentication cookies, giving them the required cookie domain. ... >> I expect to use a SQL database for session state management, ... >> My application uses web forms authentication, with a secure cookie, ie. ...
    (microsoft.public.dotnet.framework.aspnet)
  • CK-ERP v.0.10.1 released
    ... A new release, v.0.10.1, of CK-ERP, has been posted at ... vendor contract, vendor management center and vendor contact tracking ... session cannot be verified" error message will show up. ...
    (comp.os.linux.misc)
  • CK-ERP v.0.10.1 released
    ... A new release, v.0.10.1, of CK-ERP, has been posted at ... vendor contract, vendor management center and vendor contact tracking ... session cannot be verified" error message will show up. ...
    (comp.os.linux.development.apps)
  • CK-ERP v.0.10.1 released
    ... A new release, v.0.10.1, of CK-ERP, has been posted at ... vendor contract, vendor management center and vendor contact tracking ... session cannot be verified" error message will show up. ...
    (comp.os.linux.announce)