设置了多个SESSION Cookie？

Question

My site is sending two different session id cookies (PHPSESSID), one under "www.sitename.com" and the other "sitename.com".

I read this answer here which says to specify the domain used in the 5th parameter, but what about SESSION cookies which are created automatically?

I think the issue is that the facebook login used the PHPSESSID with www. in the domain while the manual login doesn't. This results in two different PHPSESSID cookies which really messes things up.

Not sure why this is happening or how to force facebook to not use www.

Answer 1

Session cookie parameters can be set in two ways:

• in php.ini file (http://php.net/manual/en/session.configuration.php#ini.session.cookie-domain);
• via session_set_cookie_params function (http://php.net/manual/en/function.session-set-cookie-params.php).

Your current setup propably provides no cookie_domain setting which causes hostname usage.

If you choose to use the function, please remember to call it BEFORE session is started (eg. before session_start). If you have session autostart turned on, the php.ini way is your only choice.