phpsessid andmodx index.php

☆ A M B ☆
275 Posts

modx.customize Reply #1, 14 years, 9 months ago

Hi there & seasons greetings!

I need each webuser to have a unique and only 1 SessionID.

So i added to index.php

  //start and get sessId or generate a new one and then pass it via http or coockie
 ini_set("session.use_trans_sid", true);
 session_start();

when I am checking the MODX revo navigation and sessions cookies I see that the session is the same for first 2-3 pages but suddenly on some page I get blank page))

But the session is the same. The URL looks like : http://site.com/services.html?phpsessid=bc1pg3739qgdc5jvi5p6jtu4t0

If I remove my code from index.php then the page by URL http://site.com/services.html is ok and shows the content.

Any idea why MODX could have problem(s) with my code?

Thanks.

modx and ecommerce pro

MODX Staff
10,725 Posts

opengeek Reply #2, 14 years, 9 months ago

MODX does not support use_trans_sid which is a known security issue and rarely ever used anymore in the PHP world.

The session management, including assigning and regenerating session ids as appropriate to prevent session fixation attacks, is done by MODX and you should not need to intervene.

Jason Coward
Chief Architect @ MODX
http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek

☆ A M B ☆
275 Posts

modx.customize Reply #3, 14 years, 9 months ago

Thanks Jason.

Just to confirm why I followed the change index.php idea:

MODX saved $_SESSION values very well when user was browsing one container's resources, ex. http://site.com/features/1.html, http://site.com/features/2.html, http://site.com/features/3.html, ..ect.

But when user navigates away from this container's resources (example: http://site.com/services.html) the $_SESSION values disappeared i.e. new SID was generated I guess.

So I decided to generate the one SID right in the controller (index.php in my case/by default)

Do not really know if I should invent anything else to keep $_SESSION vars stored on all MODX resources.. Any idea welcome, thanks.

---------------------
PS. In MODX evolution, there's shopkeeper which saves the $_SESSION[purchases] data rather good,so I was thinking I will be fine with the same way for my vars in Revo

modx and ecommerce pro