2

To explain my problem I have to add some context info:

We have a website, it works with sessions and has been working for 7 years with no problems, except for our server administrator, he can not login, and we never knew why... until now...

Our Server administrator is on vacations, so I had to do some of his works, it include login on ISP Config which is located on the same server and domain using a different port (8080), I logged there, to check some values and then when I go back to our website, I could not login, just as our server administrator.

Doing some debug I found it is a problem with sessions, on every refresh session_id() changes.

using ini_get I got session.cookie_domain and session.cookie_secure are empty.

If I do a print_r($_COOKIE) there is no PHPSESSID, if I set it to any value it dissapears, even if I write a long expiration It is not saved, If I set 2 cookies like this:

setcookie("PHPSESSID", "MYSESSION", time()+365*24*60*60, '/');
setcookie("a", "b", time()+365*24*60*60, '/');

and then print_r($_COOKIE); I get this:

Array ( [a] => b )

I don't have any .htaccess, so there is no rules in my side, seems like there is something in ISP config what changed the way I store cookies.

I could ask on webmasters.stackexchange.com but I need a PHP answer to set the new values when someone log in my website after logging in ISP config.

This is my current code to test:

<?php
session_set_cookie_params(3600,"/");
session_start();
//$_SESSION[b_id]=1;
setcookie("PHPSESSID", "GTS", time()+365*24*60*60, '/');
setcookie("a", "b", time()+365*24*60*60, '/');
echo "<div>b_id: $_SESSION[b_id]</div>";
echo "<div>session_id: ".session_id()."</div>";
echo "<div>cookie_domain: ".ini_get('session.cookie_domain')."</div>";
echo "<div>save_path: ".ini_get('session.save_path')."</div>";
echo "<div>cookie_secure: ".ini_get('session.cookie_secure')."</div>";
print_r($_COOKIE);
/*echo "<pre>";
print_r(ini_get_all());
echo "</pre>";*/
?>

This is the output, (session_id value changes each time):

b_id:
session_id: du95eljbkct54qktvcd18a7ej0
cookie_domain:
save_path: /var/lib/php/sessions
cookie_secure:
Array ( [a] => b )

This is the output of ini_get_all() function:

[session.auto_start] => Array   (
    [global_value] => 0
    [local_value] => 0
    [access] => 2
)
[session.cache_expire] => Array (
    [global_value] => 180
    [local_value] => 180
    [access] => 7
)
[session.cache_limiter] => Array    (
    [global_value] => nocache
    [local_value] => nocache
    [access] => 7
)
[session.cookie_domain] => Array    (
    [global_value] => 
    [local_value] => 
    [access] => 7
)
[session.cookie_httponly] => Array  (
    [global_value] => 
    [local_value] => 
    [access] => 7
)
[session.cookie_lifetime] => Array  (
    [global_value] => 0
    [local_value] => 3600
    [access] => 7
)
[session.cookie_path] => Array  (
    [global_value] => /
    [local_value] => /
    [access] => 7
)
[session.cookie_secure] => Array    (
    [global_value] => 
    [local_value] => 
    [access] => 7
)
[session.entropy_file] => Array (
    [global_value] => /dev/urandom
    [local_value] => /dev/urandom
    [access] => 7
)
[session.entropy_length] => Array   (
    [global_value] => 32
    [local_value] => 32
    [access] => 7
)
[session.gc_divisor] => Array   (
    [global_value] => 1000
    [local_value] => 1000
    [access] => 7
)
[session.gc_maxlifetime] => Array   (
    [global_value] => 1440
    [local_value] => 1440
    [access] => 7
)
[session.gc_probability] => Array   (
    [global_value] => 0
    [local_value] => 0
    [access] => 7
)
[session.hash_bits_per_character] => Array  (
    [global_value] => 5
    [local_value] => 5
    [access] => 7
)
[session.hash_function] => Array    (
    [global_value] => 0
    [local_value] => 0
    [access] => 7
)
[session.lazy_write] => Array   (
    [global_value] => 1
    [local_value] => 1
    [access] => 7
)
[session.name] => Array (
    [global_value] => PHPSESSID
    [local_value] => PHPSESSID
    [access] => 7
)
[session.referer_check] => Array    (
    [global_value] => 
    [local_value] => 
    [access] => 7
)
[session.save_handler] => Array (
    [global_value] => files
    [local_value] => files
    [access] => 7
)
[session.save_path] => Array    (
    [global_value] => /var/lib/php/sessions
    [local_value] => /var/lib/php/sessions
    [access] => 7
)
[session.serialize_handler] => Array    (
    [global_value] => php
    [local_value] => php
    [access] => 7
)
[session.upload_progress.cleanup] => Array  (
    [global_value] => 1
    [local_value] => 1
    [access] => 2
)
[session.upload_progress.enabled] => Array  (
    [global_value] => 1
    [local_value] => 1
    [access] => 2
)
[session.upload_progress.freq] => Array (
    [global_value] => 1%
    [local_value] => 1%
    [access] => 2
)
[session.upload_progress.min_freq] => Array (
    [global_value] => 1
    [local_value] => 1
    [access] => 2
)
[session.upload_progress.name] => Array (
    [global_value] => PHP_SESSION_UPLOAD_PROGRESS
    [local_value] => PHP_SESSION_UPLOAD_PROGRESS
    [access] => 2
)
[session.upload_progress.prefix] => Array   (
    [global_value] => upload_progress_
    [local_value] => upload_progress_
    [access] => 2
)
[session.use_cookies] => Array  (
    [global_value] => 1
    [local_value] => 1
    [access] => 7
)
[session.use_only_cookies] => Array (
    [global_value] => 1
    [local_value] => 1
    [access] => 7
)
[session.use_strict_mode] => Array  (
    [global_value] => 0
    [local_value] => 0
    [access] => 7
)
[session.use_trans_sid] => Array    (
    [global_value] => 0
    [local_value] => 0
    [access] => 7
)
[session.cookie_domain] => Array    (
    [global_value] => 
    [local_value] => 
    [access] => 7
)
[session.cookie_httponly] => Array  (
    [global_value] => 
    [local_value] => 
    [access] => 7
)
[session.cookie_lifetime] => Array  (
    [global_value] => 0
    [local_value] => 3600
    [access] => 7
)
[session.cookie_path] => Array  (
    [global_value] => /
    [local_value] => /
    [access] => 7
)
[session.cookie_secure] => Array    (
    [global_value] => 
    [local_value] => 
    [access] => 7
)

How to go back my session system to default as before logging in ISP config?


Opening page in incognito mode let me login normally and PHPSESSID doesn't change.

Clearing cookies didn't work, PHPSESSID still changing.

phpinfo gave me some relevant info:

Set-Cookie: PHPSESSID=ositfoouhvosgcklk2k14r7t25; expires=Fri, 07-Dec-2018 19:28:01 GMT; Max-Age=3600; path=/
// This is the same time it was created, so it is creating and expiring inmediately!

Expires: Thu, 19 Nov 1981 08:52:00 GMT
// 1981!?

I have a co-worker (in the same network) who can login in my website.


After 2 days, I am unable to fix the problem, we made a new test today to reproduce this error, our web developer logged on ISP Config and now he is unable to log in in my system!!

Same error as me and our server administrator.

I am using Chrome in Windows 10.

ISP Config version 3.1.11

Seems like this guy had the same issue 6 years ago: https://stackoverflow.com/questions/10255214/phpsessid-not-being-saved-to-cookie

closed as unclear what you're asking by Stephen Ostermiller Dec 8 '18 at 12:42

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • "I could not login, just as our server administrator." - Can you login as a different user? Or any user whilst sat at the "server administrators" machine? Or any machine after accessing the "ISP Config"? What's the "ISP Config"? When you are setting the above two cookies (with setcookie()) you presumably have no other code that might conflict? Check the HTTP response headers (ie. Set-Cookie header) and the stored cookies in the browser - is it possible that it is somehow set under a different domain? A notable omission in your code above is that the cookie is only set on the current host. – MrWhite Dec 8 '18 at 0:28
  • We don't have enough information from you to help you solve this. It sounds like the ISP config app may be setting its own cookies which interfere with your site's cookies. Can you edit your question to show cookies before and after logging into it? – Stephen Ostermiller Dec 8 '18 at 12:42
  • MrWhite, ISP Config is a web Hosting Control Panel for Linux ( ispconfig.org ), I added some additional info from Stackoverflow in my post. – stramin Dec 10 '18 at 14:51
  • I am having the same issue. My ISPConfig is on domain example.com:8080 and the site having issues is on sub.example.com. If I goto sub.example.com in incognito mode the site works fine. If I am logged into ISPConfig the browser shows no cookies for sub.example.com. I can see the session files being created on the server. – Fluinc Dec 11 '18 at 3:03
  • It is the same for me, I am also using port 8080 for ISP config, I posted this on Stackoverflow, and there are some useful coments, check here: stackoverflow.com/questions/53671777/… – stramin Dec 11 '18 at 11:34

Browse other questions tagged or ask your own question.