79

I use PHP sessions (not cookies, except for session id cookie) for all user data, and when a user goes to their profile user.mydomain.example they are immediately "logged out" until then remove the subdomain.

Is there a way to accept sessions from all domains as long as its *.mydomain.example

1

10 Answers 10

99

Here are 4 options.

Place this in your php.ini:

session.cookie_domain = ".example.com"

Or in your .htaccess:

php_value session.cookie_domain .example.com

Or as the first thing in your script:

ini_set('session.cookie_domain', '.example.com' );

Or in your php-fpm pool configuration for your site:

php_value[session.cookie_domain] = .example.com
11
  • 2
    Unfortunately all 3 failed to work, does there need to be a star * ?
    – Anthony
    Mar 14, 2009 at 0:11
  • 2
    Very strange, I've used the those methods before and they work fine. Do you by chance have Suhosin installed, I remember there be a setting that needed to be changed to allow this? If you don't, can you post more info about your install (eg. apache, lighttpd, php version)?
    – CTT
    Mar 14, 2009 at 0:25
  • 4
    @CTT please add a forth option to your answer: session_set_cookie_params(0, '/', 'example.com', false, false); Jun 5, 2012 at 9:05
  • 8
    Dont forget to actually close the browser then open it again. Otherwise your going to go in circles! .. i did
    – AndrewC
    May 8, 2013 at 16:11
  • 9
    Another reminder for dumb people like me: make sure ini_set('session.cookie_domain', '.example.com'); comes before session_start();
    – Ben Y
    Sep 21, 2013 at 0:25
13
        if(isset($_COOKIE['session_id']))
            session_id($_COOKIE['session_id']);
        Zend_Session::start(); //or session_start();
        if(!isset($_COOKIE['session_id']))
            setcookie('session_id', session_id(), 0, '/', '.yourdomain.example');

security be damned, if you are as frustrated with incomplete or bad answers as I am, this is your savior. It just works.

1
  • 3
    this worked for me, but I don't understand the security issue. Would you mind explaining what security issues might be there?
    – Neo
    Oct 17, 2017 at 5:38
6

change the session name at the top of the core functions file like

 session_name('mysession');

then use the following code into the php page

  session_set_cookie_params(0,"/",".example.com",FALSE,FALSE);
  setcookie(session_name(), session_id(),0,"/","example.com");
  session_start();

finally change the default session name of the subdomain and remove the default cookie in subdomain's core functions file like:

 /*default session name*/
 session_name("mysession");
 /*remove the PHPSESSID and default session name from subdomain's cookie*/
 setcookie( "mysession", "",1,"/" );
 setcookie( "PHPSESSID", "",1,"/" );

if you continue with using your cookie name as PHPSESSID ,just remove all the functions with

 "mysession" string like session_name('mysession'), setcookie( "mysession", "",1,"/" );

then check your browser's existing cookies, just remove all the cookies of domain and subdomain, and repeat the process.

1
  • This did the job for me. None of other answers in this question worked.
    – Art Geigel
    Feb 5, 2016 at 18:37
4

I know this is quite old - but to further expand on @CTT's suggestion - I needed to add a php.ini file in each sub-directory (that will be executing php code and requires the session) of my subdomain with the following text:

suhosin.session.cryptdocroot=Off
suhosin.cookie.cryptdocroot=Off

I hope this helps (it took me ages to figure this out).

1
  • This one is evil, been debugging for 2 hours now, as session sharing been working fine on my local environment. should have checked suhosin settings earlier
    – weyandch
    Apr 27, 2014 at 23:09
4

Another option that worked for me: is to force the name of the session:

session_name("myWebsite");
session_start(); 
1
  • 1
    This by far seems like the simplest solution
    – Adam
    Jun 1, 2018 at 4:31
4

yes. ini_set is working. but remember to destroy all caches and cookies of the browser to see it works.

  1. destroy all caches and cookies of your browser
  2. in your xxx.example.com and yyy.example.com, your php files should start like this.

    ini_set('session.cookie_domain', '.example.com' ); session_start();
    
0

I just had this problem and it turns out I was using different php.ini files for two different sub-domains. These ini files specified different session.save_path variables. For obvious reasons this needs to be the same for all sub-domains that need to share sessions.

0

Before session_start() use session_set_cookie_params() replacing .domain.example with your domain like this example:

session_set_cookie_params(0, '/', '.domain.example');
session_start();
0

Try This:

session_start();

$sessionId =  session_id();

logged the user. When user will switch to other subdomain sent the session id in the URL like this user.mydomain.example/?id=$sessionId

$sessionId =  $_GET['id'];

session_start($sessionId);

Now the user will get all the session values and stay logged in.

1
  • 8
    If your answer starts with "try this" you're doing it wrong. Apr 10, 2018 at 12:58
-3
if(isset($_COOKIE['session_id']))
    session_id($_COOKIE['session_id']);
    Zend_Session::start(); //or session_start();

    if(!isset($_COOKIE['session_id']))
        setcookie('session_id', session_id(), 0, '/', '.yourdomain.example');

This is a good solution, but you cannot use it in all situations. For examples it will not work when you cannot rely on not-session cookies.

This actually MUST work if you use it correctly.

ini_set('session.cookie_domain', '.example.com' );

For example you need to put it before session_start() and also in all files that call session_start()

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.