i was trying to make one sessions for my all subdomains (one session across subdomains)

subdomain number one


session_set_cookie_params(0, '/', '.site.com');
echo session_id().'<br />';
$_SESSION['stop']='stopsss this';

subdomain number two


session_set_cookie_params(0, '/', '.site.com');
echo session_id().'<br />';

Now when i visit auth.site.com/session_test.php

i get this result

Array ( [stop] => stopsss this ) 

And when i visit anscript.site.com/session_test.php

i get this result

Array () 

session id is same!

but session is empty

after two days of failed trys, finally i detected the problem

the problem is in file promissions

the file is not readable by the another user

session file on my server

-rw-------  1 auth auth 25 Jul 11 11:07 sess_06pqdthgi49oq7jnlvuvsr95q1

when i make this command on the server

chmod 777 sess_06pqdthgi49oq7jnlvuvsr95q1

i get the problem fixed!! the file is became readable by (anscript.site.com)

So, how to fix this problem? How to set the default promissions on session files?

this is the promissions of the sessions directory

Access: (0777/drwxrwxrwx)  Uid: (    0/    root)   Gid: (    0/    root)

3 Answers 3


Your PHP session files must be readable by PHP/the web server, not necessarily by all users (this is a security risk).

To fix this issue, check what user your PHP (or apache with mod_php) is running as, and set the file ownership to that user for all of the session files (and the directory containing them, usually /var/lib/php/session or something similar).

chown -R user.group /var/lib/php/session
  • i have tryed this before, the directory is readable for all, and all other users can write/create new files in this dirrectory, but i talks about the session file itself, the session file name is owned by (auth) , and chmoded as (600), so other users cannot read or edit this file! but if i chmod it to 777, file becames readable by all other users,
    – Alaa Gamal
    Jul 11, 2012 at 18:25

I see two problems with your solution.

Setting the permissions to 777 makes them executable as well as readable. If you wand to make the file readable by other try 644 instead of 777. The umask used when the server is started is one of the factors the control this. If you start the server with a umask of 077, you will get the behavior you are seeing. The code storing the session may do the same.

Depending on how you configured your web server, different web servers may run as different users. It appears the secure site may be running as auth:auth rather than the id the other servers are running as. Try creating the session as different users. If you get the same ownership for all users, then it would appear you are using a program running with setuid privileges to create the session, and not consistently using that program to read your session data.

Does the auth site require HTTPS while you are accessing the other site with HTTP? If so, session security settings could prevent access.


Consider ACL's . man chacl . VAR=$(md5sum filename | cut -c1-20); attr -s "File.checksum.md5" -V "$VAR" filename

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.