Zen Follower
- Join Date:
- Jun 2012
- Posts:
- 481
- Plugin Contributions:
- 0
Cookie Problem
I have been doing some testing with cookies blocked in the client's browser. When attempting to login, the "Whoops! The session has timed out" page came up. Reading up on this I found a post by Dr. Byte stating that session.use_only_cookies in the php.ini file could cause the problem and should be set to 0. It was set to 1. When I set it to 0, I could log in successfully. The URL for each page contained the session name and ID as expected. But when cookies were unblocked in the client's browser, the session name and ID still appeared in the URL. I expected that once cookies were enabled, use of the URL for session information would no longer be necessary. A cookie was indeed stored in the browser, but the session info persists in the URL. Logging out, clearing cookies and cache, and logging back in with cookies enabled showed the session information was still being shown in the URL.
Is this behavior the design intent? I realize that if a client has blocked cookies, they create a security risk for themselves when session.use_only_cookies is set to 0, but it also creates a problem for clients with cookies enabled. The alternative is to deny site use to clients who block cookies.