Multiple modx installations, logout problem, session-id, session_path

Hello,

as i wrote yesterday i use two installations of modx on the same server.
I want to use both simultaneously, but i cant.
A login to one install kicks me out of the other (vice versa)

I think it happens because of the session-id: I guess if it is unknown to modx it generates a new one, overriding the old one from the other modx.

Well, i could use the session_path system-setting to have multiple session-id-cookies. And it works.

Only if there weren’t the folder containing the components i’m developing.

Let me try to explain that:

I have three web-accessable directories

http://myhost/modx/dev/
http://myhost/modx/test/
http://myhost/modx/mycomps/

First and second are separate modx-installations, one for developing und one for testing the packaged components.
Third is the directory that contains the components to develop.
Those components are included in http://myhost/modx/dev/ using mycomponent.assets_url and mycomponents.core_path setting.

If i now use session_path to have multiple session-id-cookies, the connector.php of any of my components wont get the session-id.
If i leave session_path "/" i cant be simultaneously in both modx-installations.

I hope you understood that

There are several other options for me beside session_path, eg subdomains.

But isn’t there some way to tell modx to not recreate the session-id?
Or maybe other suggestions to setup my development-environment on the server?

I believe you may be standing on the edge of a security issue.

If MODX could be told "not" to establish a session_id and simply use the one it finds, then we would be looking at possible hijacks.

My thought is simply this:

Why not use a single installation of MODX and have it utilize Resource/User Groups or implement Contexts to handle the "different" sites.

Hello,

thanks for response.

Quote from: wshawn at May 25, 2011, 08:37 AM

I believe you may be standing on the edge of a security issue.

If MODX could be told "not" to establish a session_id and simply use the one it finds, then we would be looking at possible hijacks.

Instead of just using the session-id found in the cookie, the session-id gets regenerated on login even if there is no data assigned to it. As there is no data assigned to the session-id, there should be no security issue with that. At least i can not see any.

Hijacks of session-ids is allways possible, thus maybe bind a session also to ips and other possible indicators, to make hijacks harder. But thoose are just more possible parameters to validate a session.

What i mean is simply that if a session-id from the user is not assigned no any record in the session-table, why not use it on login, but force a regeneration of it?

Quote from: wshawn at May 25, 2011, 08:37 AM

My thought is simply this:

Why not use a single installation of MODX and have it utilize Resource/User Groups or implement Contexts to handle the "different" sites.

For production, yes, as i build multiple sites with one modx. To create sites (be it one or multiple) one modx installation should be sufficent.

But for development, i prever to have two installation, at least for the moment. ATM i think its good to have one installation for direct testing of editet modx-extra-component code (plus maybe for documentation of that extras) and one to simply test the builded packages/transports.