破坏/重置后PHP会话无效，保持活动状态

Question

i have found a strange issue on my server (php 5.4.0, apache) regarding session handling in php.

i have a function that start the session which contains the following code and is called always before anything else in my application:

static function startSession()
{
    $httponly = true;
    $secure = true;

    if (ini_set('session.use_only_cookies', 1) === FALSE) {
        exit();
    }

    session_name("my_session");

    $cookieParams = session_get_cookie_params();

    session_set_cookie_params(
        60*60,
        $cookieParams["path"],
        $cookieParams["domain"],
        $secure,
        $httponly
    );

    session_start();
}

Then there is a login procedure which does something like that:

$_SESSION['key1] = 'some value';

session_regenerate_id(true);

And finally there is a logout function:

static function logout()
{
    $_SESSION = array();

    $params = session_get_cookie_params();

    setcookie(
        session_name(),
        '',
        time() - 42000,
        $params["path"],
        $params["domain"],
        $params["secure"],
        $params["httponly"]
    );

    return session_destroy();
}

Now to the issue: When i login the following happens:

startSession();
...
$_SESSION['key1'] = 'some_value';
...

Somehow in the future i call:

logout();

session_destroy(); returns true, $_SESSION is reset. everything fine.

I then retest the request by sending the session cookie again to request some information and the session is again alive. All the information are sill there.

On the server i can see a session file that is generated:

sess_ : 394B

i have the following session setup:

ini_set('session.hash_function', 'sha512');
ini_set('session.entropy_file', '/dev/urandom');
ini_set('session.entropy_length', 256);
ini_set('session.use_trans_sid', 0);
ini_set('session.use_only_cookies', 1);
ini_set('session.cookie_lifetime', 0);
ini_set('session.use_strict_mode', 1);
ini_set('session.cache_limiter', 'nocache');

my session_save_path() is somewhere in /var/www/html/sites/....

What am i missing or doing wrong?

Thanks in advance

Dennis

Answer 1

Ok i found the solution myself. i should have added, that i am sending requests from the iOS using objective c.

For all requests i was sending the cookie with the requests.

The problem was, that the logout wasn't sending the cookie. So i requested the logout function. As said all requests started a session. Then i reset the session and destroyed it.

That means: request login - generates session: abc123 request logout - generates new session: xyz456 - log out session xyz456 - abc123 stays logged in.

So my advice is, make sure you are destroying the right session :)