Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i was trying to make one sessions for my all subdomains (one session across subdomains)

subdomain number one

auth.site.com/session_test.php


session_set_cookie_params(0, '/', '.site.com');
session_start();
echo session_id().'<br />';
$_SESSION['stop']='stopsss this';
print_r($_SESSION);

subdomain number two

anscript.site.com/session_test.php

session_set_cookie_params(0, '/', '.site.com');
session_start();
echo session_id().'<br />';
print_r($_SESSION);

Now when i visit auth.site.com/session_test.php

i get this result

06pqdthgi49oq7jnlvuvsr95q1
Array ( [stop] => stopsss this ) 

And when i visit anscript.site.com/session_test.php

i get this result

06pqdthgi49oq7jnlvuvsr95q1
Array () 

session id is same!

but session is empty

after two days of failed trys, finally i detected the problem

the problem is in file promissions

the file is not readable by the another user

session file on my server

-rw-------  1 auth auth 25 Jul 11 11:07 sess_06pqdthgi49oq7jnlvuvsr95q1

when i make this command on the server

chmod 777 sess_06pqdthgi49oq7jnlvuvsr95q1

i get the problem fixed!! the file is became readable by (anscript.site.com)

So, how to fix this problem? How to set the default promissions on session files?

this is the promissions of the sessions directory

Access: (0777/drwxrwxrwx)  Uid: (    0/    root)   Gid: (    0/    root)
share|improve this question

3 Answers 3

Your PHP session files must be readable by PHP/the web server, not necessarily by all users (this is a security risk).

To fix this issue, check what user your PHP (or apache with mod_php) is running as, and set the file ownership to that user for all of the session files (and the directory containing them, usually /var/lib/php/session or something similar).

chown -R user.group /var/lib/php/session
share|improve this answer
    
i have tryed this before, the directory is readable for all, and all other users can write/create new files in this dirrectory, but i talks about the session file itself, the session file name is owned by (auth) , and chmoded as (600), so other users cannot read or edit this file! but if i chmod it to 777, file becames readable by all other users, –  Alaa Gamal Jul 11 '12 at 18:25

I see two problems with your solution.

Setting the permissions to 777 makes them executable as well as readable. If you wand to make the file readable by other try 644 instead of 777. The umask used when the server is started is one of the factors the control this. If you start the server with a umask of 077, you will get the behavior you are seeing. The code storing the session may do the same.

Depending on how you configured your web server, different web servers may run as different users. It appears the secure site may be running as auth:auth rather than the id the other servers are running as. Try creating the session as different users. If you get the same ownership for all users, then it would appear you are using a program running with setuid privileges to create the session, and not consistently using that program to read your session data.

Does the auth site require HTTPS while you are accessing the other site with HTTP? If so, session security settings could prevent access.

share|improve this answer

Consider ACL's . man chacl . VAR=$(md5sum filename | cut -c1-20); attr -s "File.checksum.md5" -V "$VAR" filename

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.