CODEWITHSUNDEEP
phpzend-frameworksessionsession-cookies
Trent
Trent

Reputation: 5877

Why do I have two session id in my header?

I'm using PHP5.3, Apache 2.2 and Zend Framework 1.11 and when I do a request with curl, I got two Set-Cookie headers with two differents session id.

Any ideas?

> POST /api/register HTTP/1.1
> Authorization: Basic Ymd1ZXJ0eQ==
> Host: api.domain.tld
> Accept: */*
> Content-Length: 66
> Content-Type: application/x-www-form-urlencoded
> 
< HTTP/1.1 200 OK
< Date: Wed, 07 Dec 2011 13:27:07 GMT
< Server: Apache
< X-Powered-By: PHP/5.3.8
< Set-Cookie: SESSID=vtvackh55bj1up3ouoq4bhk545; expires=Thu, 06-Dec-2012 19:15:53 GMT; path=/
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
< Pragma: no-cache
< Set-Cookie: SESSID=79a1g98e0pkqlq8fo7elpe9492; expires=Thu, 06-Dec-2012 19:15:53 GMT; path=/
< Vary: Accept-Encoding,User-Agent
< Content-Length: 128
< Content-Type: application/json

Upvotes: 5

Views: 2361

Answers (2)

Łukasz Gawron
Łukasz Gawron

Reputation: 917

From Zend 1.11 documentation:

By default, Zend_Auth provides persistent storage of the identity from a successful authentication attempt using the PHP session.

Maybe you used somewhere AuthAdapter which start session and later on you are trying to manipulate it on your own starting another session with different session id.

I've experienced this issue in Zend 2.
I first used AuthenticationService to authenticate and after successful authentication I tried to use Zend Session Container to manipulate session.
I've used session container to explicitly regenerateId() and set some additional headers like secure, http_only and as a result I had two session headers like you.

Upvotes: 0

Halcyon
Halcyon

Reputation: 57703

Your server application is emitting the Set-Cookie header twice. This can come from anywhere, impossible to tell without seeing all the code.

Look for things that deal with session handling. If there is third party code involved, disable it and see if the problem persists.

Upvotes: 2

Related Questions