PHPSESSID not respecting session_cookie_domain

(Using clean 2.1.2 Advanced)

Trying to set up a cookie-less subdomain.

Session settings:
session_cookie_domain: markhamstra.com
session_cookie_lifetime: 604800 (default)
session_cookie_path: / (default)
session_cookie_secure: no (default)
session_gc_maxlifetime: 604800 (default)
session_handler_class: modSessionHandler (default)
session_name: empty (default)

PHP 5.2.17, MySQL 5.0.91, tested in Firefox 5


After clearing the cookies and visiting the manager, that sets two cookies, one PHPSESSID which is set to .markhamstra.com, and another one ys-modx-resource-tree which is properly set to markhamstra.com.


I’m curious as for why PHPSESSID doesn’t respect the setting Is this a bug, or intentional architectured for reasons beyond my understanding?

I don’t follow your question at all Mark. MODX always requires a cookie so I’m not sure what you mean by trying to set-up a cookie-less subdomain. Also, is your session_cookie_domain value set to .markhamstra,com or markhamstra.com, cause there is a big difference.

The cookie setting (in this test) didn’t have the dot.

Was trying to set up a cookie-less subdomain for assets - like a mini-cdn that doesn’t send cookies. Ie static.site.com. The manager cookies (ys-modx-resource-tree) respects the session_cookie_domain setting, but the PHPSESSID one doesn’t and uses the domain with a dot.

If this is just me being crazy (from what I can find the session_start() function in PHP sets that cookie) and not understanding the deeper parts of what’s going on in PHP just say so

Oh - and the subdomain isn’t controlled by MODX but would just hold static images and js that doesn’t need access to cookies / sessions.

And after rethinking the whole cookie-less domain thing and some of my future plans I figured it’d be easier to just order a separate domain to serve static content from instead of the subdomain "solution". So this is more curiosity now than a bug or feature request or anything.