php sessions and subdomains

sessions across subdomains

[anawaz]

Hi folks,

This question has been asked before and it also has been answered before, but the answers don't seem to work for me thus far. I'm using a dedicated sever for an application - we've got cPanel. Subdomains are being generated dynamically via htaccess, and here is the code for that:

RewriteCond %{HTTP_HOST} ^([^\.]+)\.example\.com$ [NC]
RewriteRule ^(.*)/$ http://example.com/usergalleries/$1?subdomain=%1 [P,L]

Now, we have users who visit the site on sub1.example.com and a session gets created, which then needs to be visible on http://example.com directly. I have been unable to do it with the 3 following options:

1. Setting the session.cookie_domain to ".domain.com". No luck with this. It doesn't work when going from SUBdomain to domain. Also note that we don't have www.example.com as the main domain, just example.com.

2. Setting the value to force the session.cookie_domain via htaccess results in an internal server error

3. Using ini_set() doesn't help either.

So, I'm a little frustrated because I'm not sure what the problem is. We don't have suhosin installed, so that shouldn't be the issue.

Ideally I would like to do something at the php.ini level. Failing that, perhaps inside my script.

Finally, assuming we can get this to work at the php.ini level, if we have 2 domains, how would we accomplish putting to domains in the session.cookie_domain field in cPanel. Do we split them with a comma or semicolon or a space?

Thanks for your help!

[anawaz]

I just tried and it works in IE, but not in FireFox or Chrome or Opera. So, how do I get them to work in these browsers?

[enigma1]

You are issuing a cookie to a sub-domain and want to use it on the main domain. That won't work.

You will have to pass a session id via the url so the landing url to the main domain may look like:
http://example.com?sid=123
then assuming you use the same storage (db or a method to communicate across domains), you check the sid if it is stored and retrieve the user's private data. And this can work across different domains too.

[anawaz]

Thanks enigma, think I will have to use the DB to manage this particular session too. I really wanted to keep the database out of session handling. Only reason I'm having to do this is because I wanted enterprise level SSL validation on the main domain. If I had wildcard, I could process the damn transactions on submdomain itself, but then you don't get the green bar and all that good stuff!