php session issues the same session_id for different users on different computers

I have a web app, which I’m testing now. And for some reason I can’t get the sessions work properly. They work good on my local site though.

Here’s the problem. For some reason PHP issues the same session_id value for different users whenever they access the website. And yes, I’m deleting the cookies before testing, so that’s not where the problem lies.

This causes user 1 to be logged in as user 2 without entering username/password combination. I use session cookie along with other cookie values for persistent logging in. I don’t know why it happens, but it’s all because the two users share the same session cookie value.

I noticed that the session_id is the same when the time difference between accessing the site is little (about 10-20 seconds). More than 20 secs – users received different session_id values (which is a good thing).

I really tried all possible scenarios: – two different computers, same browsers – two different computers, different browsers – one computer, different browsers

In total, I used three different computers and three different browsers, but to no avail.

I use the standard session_id() algorithm, I didn’t really change anything, everything is pretty standard.

Edit:

(added code)

$session_start(); 

if(!isset($_SESSION['login_check']) || $_SESSION['login_check']==0)
{
    $_SESSION['login_check'] = 1;

    if(isset($_COOKIE['user_id']) && isset($_COOKIE['session_id']))
    {
        $user = find_user($_COOKIE['user_id']);


        if($user->sid == $_COOKIE['session_id'])
        {
            // extending the cookies
            setcookie('user_id', $user->id, time() + 3600*24*14, "/", null, null, true);
            setcookie('session_id', uniqid(rand(), true), time() + 3600*24*14, "/", null, null, true);


        }
    }
}

JavaScript
​x
 
$session_start(); ​if(!isset($_SESSION['login_check']) || $_SESSION['login_check']==0){    $_SESSION['login_check'] = 1;​    if(isset($_COOKIE['user_id']) && isset($_COOKIE['session_id']))    {        $user = find_user($_COOKIE['user_id']);​​        if($user->sid == $_COOKIE['session_id'])        {            // extending the cookies            setcookie('user_id', $user->id, time() + 3600*24*14, "/", null, null, true);            setcookie('session_id', uniqid(rand(), true), time() + 3600*24*14, "/", null, null, true);​​        }    }}​

I don’t call session_id() anywhere in my code.

Answer

I don’t know if it’s right, but you could try to use the sessions on mysql.
Maybe it can help you: http://www.devshed.com/c/a/mysql/custom-session-management-using-php-and-mysql/

Advertisement

Answer