CodeIgniter Session Problems Thread

[eluser]mrbinky3000[/eluser]
CI's Session Library is FLAWED.

UPDATED: 11/20/2009

The following applies to version 1.7.2 of CodeIgniter.

- Trying to use DX_auth or other authentication libraries but end-users using Internet Explorer experience mysterious spontaneous log-outs or people can't log in?

- Is your session data disappearing for IE users while your FireFox and Safari users have no problems?

- Tired of seasoned CI veterans on this forum telling you the problem is YOU not CI?

If so, you're at the right thread.

Here is what you need to know about CI's Sessions.

Okay, so here's the long and short of it. CI's session library creates standards-compliant cookies that work reliably on all web browsers except for Internet Explorer 6,7,8 and so on. The reason being, Internet Explorer doesn't follow standards (link). Kudos for CI. Shame on IE. We all know that Microsoft's browser is a piece of poop. It still doesn't change the fact that tons of people still use it because they either don't care, don't know, or don't have a choice (company-owned computer). Rather than accommodate Internet Explorer users, CI coders and CI uber-fans would prefer that you start a revolt, shun the 40% to 50% of users who use IE, lose your paying web development clients, and/or get fired.

Obviously, lots of people encounter no problems whatsoever when using CI's session class, which makes those of us who do have problems frustrated. Just know your not alone. A quick search on this forum revealed over 600 other posts from people having questions or issues with CI's session class. The problem may lie with your host's web server, it may lie with your visitor's web browser, it may be that your code doesn't accomodate CI somehow. Regardless, by introducing a new layer between PHP's perfectly adequate native session routines and the end user, CI's session class also inevitably introduces new and annoyingly mysterious problems.

So, why invest time and effort writing code that relies on CI's sessions when, at some point in the future, unforeseen server or browser changes have the potential of ruining your code?

I say, avoid the problems in the first place. So...

IF YOU HAVE A CHOICE:

- Starting a new project? Don't use CI's session class. Just write code like you normally would outside of the CI framework. Meaning: use PHP's native session handling functions like session_start(), unset(), session_destroy() and the $_SESSION superglobal.

- By default, PHP stores data on the server in a world-readable location, like "/tmp". If you are hosted on a chrooted virtual or dedicated server, then (for the most part) there is no need to be worried. However, if you are on a traditional shared server, like at an ISP, there are PHP configuration settings you can tweak to change the location where PHP stores session data. For example, on Apache servers you can set up a special .htaccess file. Google that for more information.

IF YOU'RE STUCK WITH CI_SESSION:

- Did you inherit a project that relies on CI's session class?

- Is your favorite 3rd party library dependant on CI's session class?

If you absolutely MUST use CI's session class, your best option is to completely replace CI's session class with one that uses PHP's rock-solid native session handling routines.


Current Recommended Replacements:

Dariusz Debowczyk's Session Class

I found this solution while surfing the net for constructive help. Dariusz's orginal class was intended for versions prior to 1.7.2. You place it in your application/libraries folder and it completely circumvents CI's session class. I tweaked some method and property names to make it work with 1.7.2. You can find the updated code here...

http://codeigniter.com/wiki/Dariusz_Debo...ion_Class/

Directions for how to install the class in your application are also on the above wiki page. Please keep in mind, the Dariusz hack is that, a hack. It needs to be improved. Hopefully you, the reader, can improve it over time. If you do end up improving it, please reply to this thread with your updated code.

Can't Replace CI session class?

I feel your pain, but like I said earlier, lots of people don't have issues with CI's session class. Perhaps all you need to do is...

Double check your settings.

- Examine your cookie settings in /application/config/config.php A CI vetran recomended removing underscores from the cookie name (link). This can be done by changing:

Code:

$config['sess_cookie_name']        = 'ci_session';

to

Code:

$config['sess_cookie_name']        = 'cisession';

Also remove any underscore in $config['cookie_prefix'] since it is prefixed to the cookie name.

Double-Check Your Server's Time and Timezone

Make sure your server's time is correct. All browsers set cookies based on the client's time. IE on the other hand, goes by server time. If the server's time is in the past, cookies will expire as soon as they are set thus giving the illusion that your cookie never arrived.