Session files created each request, but session not restored

[b3n]

Hi

Just installed a completely fresh and untouched copy of OpenCart 1.5.3.1 and I couldn't login as admin, so I tried out the homepage and saw that sessions were not working (cart didn't persist across pages). In the session folder, every time I refresh the page, I see three different session files created... I put an echo above/below the session check in system/library/session.php and it always returns a blank session_id first, which causes session_start() to run and create a new session_id, which it does successfully. This is stored in a session cookie in the browser (Firefox) fine, but after the refresh this cycle continues as though it never happened.

This is a regular CentOS machine that has a few other sites on it all running sessions fine, so I don't want to change any php.ini settings on speculation. Instead, I'm wondering if there is anything special/different about how OpenCart handles sessions? Has anyone come across anything like this before? I've set up a number of OpenCart sites in the past without seeing this, have I just missed something obvious this time round? (Everything was green on the Installation wizard, and there were no errors throughout)

Thanks for taking a look, any advice would be much appreciated!

EDIT

Some more debugging, looks like it's not an OpenCart problem at all, I've created the following file:

Code: Select all

<?
error_reporting(-1);

session_start();
echo print_r($_SESSION,true).'<br />';

$_SESSION['testvar'] = 'testing';

echo 'session_id after creation: '.session_id().'<br />';


No errors/warnings, nothing is ever saved in the $_SESSION, and the session_id() is replaced every request... yet session files are being created in the session.save_path as defined in php.ini and session cookie in the browser (Firefox & IE) is updated each time.

[MarketInSG]

Try contacting your host for it. My guess is that you are using godaddy?

[b3n]

Try contacting your host for it. My guess is that you are using godaddy?

No, actually, it's our own machine. After some more digging I think it may be a server wide problem that we just haven't seen before - the other sites are running Magento, which I believe handles sessions itself using the database (not researched, just from memory) because I tried the same test script in a webroot there and it also doesn't work. I also tested the script on another machine, that I know runs OpenCart (for example) and it does as I'd expect: after the first page load $_SESSION holds the 'testvar' value and the session_id() is unchanged between page requests.

Thanks anyway though, you came up with the right culprit!

[JAY6390]

Interesting anomaly. I've never seen anything quite like this. If you find out what causes the issue please report back as I'm intrigued

[b3n]

Well, pleased to report I tracked it down - and I've learned my lesson about inheriting from other companies! This machine was a clone of a live site that we inherited, and up till now it had been fine as the dev platform for that site. We'd obviously not used it enough to run into any problems though...

Turns out session.cookie_secure was set to On in php.ini rather than the default Off. This broke sessions completely, and silently, for anything not running over an HTTPS connection. Wonderful!

Sorry for jumping to the OpenCart forums, but who knows, someone might find this useful some day

EDIT:
And yes, it is counter-intuitive that I could see the session_id in the browser's session cookie, it must have just been ignored by the server as it wasn't being returned over HTTPS.

[JAY6390]

Certainly something to remember that's for sure Glad to hear you got it resolved