Code Igniter Session problem

[eluser]WanWizard[/eluser]
All session solutions require proper configuration, and proper understanding of the cookie mechanism.

Most of the problems reported fall in the first category, a problem which is becoming bigger now that modern browsers implement a stricter enforcement of the cookie RFC. For example, you will see that browsers that enforce this RFC, will reject cookies with hostname 'localhost'. Also empty domains, or domains like ".com" will be rejected, and hostnames and/or domains that don't match the host/domain in the URL.

Second thing to understand is that sessions are implemented using a cookie. The cookie is sent to the browser in the HTTP header of the server reponse, and contains (at least) the session_id. When a new request to that same server is made, the cookie is sent back to the server in the HTTP header, where it is picked up by the application, which matches the session_id from the cookie with session data in whatever server side storage mechanism is chosen.

Knowing this, you have to be careful with anything that interferes with the normal request/response flow. In particular, redirects. A redirect interrupts the server response, which in some situations causes the cookie not to be send to the browser.
If this happens when the browser already has a valid cookie, there is no issue. If this happens when it's a new session, or when CI has just rotated the session_id (which by default happens every 300 seconds), you have an issue, because the session_id on the server doesn't match what you have on the client.

You have a similar issue with Ajax calls. The response of an Ajax call doesn't include a cookie. So if CI decides that it's time to rotate the session_id on an Ajax call, again the session_id on the server is updated, but the cookie in the browser still has the old session_id. So at the next page request, no valid session is found.

And then there are server side bugs. One well known one concerns IIS up to version 7, which deletes cookies from the HTTP header if that same header contains a "Location" redirect.

Also some browsers appear not to process/store cookies if the HTTP header contains a "Location" redirect.