Sessions and AJAX Requests

This is somewhat related to my other comment about AJAX but I decided to make a new thread here because it’s more of a "sup with this" type of thing.

Anyways, I have an application with a ’backend’ and a ’frontend’. The backend is only accessible to specific members, and has a few basic AJAX functions. For instance, I allow people to "report" outdated/incorrect entries on the frontend, which is logged into the database and displayed for DB manager users in the backend. The AJAX part is in displaying the individual reports and toggling the reports open/closed.

Now, I created an external script and created a new instance of the document parser. All my MODx database calls work fine, but the issue is with calls like $modx->getLoginUserName() and $modx->isMemberOfWebGroup... they don’t appear to have anything in them when the AJAX request is processed (and yes, I’m logged into the frontend). It worked fine when I made the AJAX script a separate snippet, but having the AJAX stuff in an external file seems to load 5-6 times faster, so that seems like the best choice. But I need to verify that the user is actually able to carry out the admin functions, and it doesn’t look like that’s working.

It seems like it’s an issue with sessions and MODx but I’m not sure what it could be. Or maybe I’m just missing something. Any help would be appreciated!

Just a follow-up, for anyone who might need this in the future:

I couldn’t figure out why the sessions weren’t being carried over, even when session_start() was called at the start of the script. I tried everything I could think of, and I settled for a much less elegant solution at first. Basically, on the main page (where the AJAX request would initially take place), I set two cookies: one for the user’s id, and another for the user’s password hash, both of which were already stored as session data. During the AJAX request I simply validated the data by calling getWebUserInfo() (for the real password) and comparing them to check that they’re really the user. Then I got the user’s web groups and went from there.

Evidently, not the best solution, and not much in terms of finesse. After some digging, I realized that (silly me!) MODx sessions are named when you first run the installer (and therefore, calling session_start() would naturally have no effect unless you told it what the name of the session is). So all I did was call startCMSSession() after including the MODx config file in my script, and BINGO, everything works flawlessly. Doh!

So if you need your external AJAX scripts to validate users or take advantage of certain MODx API functions (getWebUserInfo(), getLoginUserId(), etc), call startCMSSession() after including the config file for MODx and you’ll be all set.

I hope this helps someone!