[Solved] Various Session problems

[eluser]bretticus[/eluser]
[quote author="WanWizard" date="1282258118"]
4. Whats your production setup? Any load balancers, reverse proxies, application firewalls in place?[/quote]

Some load balancers will proxy the data (the load balancer becomes the web server point of demarcation.) In that case, the ip that you can grab via $_SERVER['REMOTE_ADDR'] (which is the mechanism sessions ultimately use) will come to your web server as the IP of the load balancer (the same everytime.) Often a load balancer will send some header to designate the real remote address. Try issuing a print_r($_SERVER) and see if you can find the real remote address. From there, you can use my extended Input class...

http://brettic.us/

(I would have linked it but I get a nice "black listed item found" error when I try to update this post. Huh??? Just look for the "PHP: Remote IP + Load Balancer" link as I can't even write that URL in the forum. Hmmm... I suppose my class could be used by a malicious hacker to mask his IP in a scenario where the load balancer DOES NOT use that header. Maybe I better put a disclaimer in. Still? blacklist it? You should never count on headers for anything secure anyway!)


...to look for that value first (and modify it for your needs depending on your output form printing the $_SERVER array.)

Make sure your AJAX calls have the same useragent as the browser. I noticed you have

Code:

$config['sess_match_useragent']    = TRUE;

In firefox the user agents are the same for ajax vs browser (I checked via firebug.) I dunno about other browsers.