dongyun9120 2013-10-29 13:15
浏览 57

CodeIgniter会话ID更改但无法正常工作

Because of our payment system we have to use some kind of relay system that is on third party website, to have valid PCI (HTTPS).

We are currently facing a wierd bug we have used too many hours on now.

We have 4 steps in our registration.

  1. Enter all the data.
  2. Add images
  3. Payment

This is how we do: On step 1 we save all post data into a session $this->session->set_userdata("campaigncreation", $out); And yes $out contains all the data.

On step we can easily print out the session data for campaigncreation; <?print_r($this->session->userdata)?>

Because we need to go to another website, we add the session_id into our call, to keep the session on third party website.

Our url is like: https://relay.ditonlinebetalingssystem.dk/relay/v2/relay.cgi/http://xxxx.dk/something/controller/a1264526031adb9c71ae433eef44bfa0

As you see we take the session_id (<?=$this->session->userdata("session_id")?>) in the URL, and in our controller we replace the session id with that in the controller as this:

$phpsess is "a1264526031adb9c71ae433eef44bfa0"

if ( !empty($phpsess)){
            $this->session->set_userdata("session_id",$phpsess);
}

When we now print out the user data we get the correctly session_id, but it doesn't take the data with us from step 1 in some how. What do to?

I only get

 Array
(
[session_id] => a1264526031adb9c71ae433eef44bfa0
[ip_address] => 87.54.46.121
[user_agent] => Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36
[last_activity] => 1383052142
[user_data] => 
[advertiser_id] => 1
[advertiser_name] => xxxx

)

But in some way it still have the correct data for advertiser_id and advertiser_name, so that is totally wierd.

What do to?

It's like codeigniter refresh the session_id on each page load and therefore there will be problem.

Or maybe because of the domain cookie settings? I dont know, please help us.

  • 写回答

5条回答 默认 最新

  • doutao4938 2013-10-29 20:52
    关注

    It's called session rotation and it's actually a security feature in CodeIgniter, I would not recommend disabling it, rather, create a table for your references and attach a single use authorization token in each request to another domain.

    Then from your second domain cross reference the token server side.

    Let me know if you need more details =]

    You can see one of my answers about the same subject here:
    IonAuth - seems to be randomly logging me out

    评论

报告相同问题?

悬赏问题

  • ¥15 keil的map文件中Image component sizes各项意思
  • ¥30 BC260Y用MQTT向阿里云发布主题消息一直错误
  • ¥20 求个正点原子stm32f407开发版的贪吃蛇游戏
  • ¥15 划分vlan后,链路不通了?
  • ¥20 求各位懂行的人,注册表能不能看到usb使用得具体信息,干了什么,传输了什么数据
  • ¥15 Vue3 大型图片数据拖动排序
  • ¥15 Centos / PETGEM
  • ¥15 划分vlan后不通了
  • ¥20 用雷电模拟器安装百达屋apk一直闪退
  • ¥15 算能科技20240506咨询(拒绝大模型回答)