passing session id via url

php url session ini-set
picture · May 6, 2009 · Viewed 44.9k times · Source

I'm trying to get my script to use url session id instead of cookies. The following page is not picking up the variable in the url as the session id. I must be missing something.

First page http://www.website.com/start.php

ini_set("session.use_cookies",0);
ini_set("session.use_trans_sid",1);
session_start();
$session_id = session_id();
header("location: target.php?session_id=". $session_id );

Following page - http://www.website.com/target.php?session_id=rj3ids98dhpa0mcf3jc89mq1t0

ini_set("session.use_cookies",0);
ini_set("session.use_trans_sid",1);
print_r($_SESSION);
print(session_id())

Result is a different session id and the session is blank.

Array ( [debug] => no ) pt1t38347bs6jc9ruv2ecpv7o2

Answer

stefs picture stefs · May 6, 2009

be careful when using the url to pass session ids, that could lead to session hijacking via the referer!

Related questions

Get the full URL in PHP

I use this code to get the full URL: $actual_link = 'http://'.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF']; The problem is that I use some masks in my .htaccess, so what we see in the URL is not always …

Read More
Remove all special characters from a string

I am facing an issue with URLs, I want to be able to convert titles that could contain anything and have them stripped of all special characters so they only have letters and numbers and of course I would like …

Read More
Get URL query string parameters

What is the "less code needed" way to get parameters from a URL query string which is formatted like the following? www.mysite.com/category/subcategory?myqueryhash Output should be: myqueryhash I am aware of this approach: www.mysite.com/…

Read More