PHP 会话在 SSL 上重置
这是一个常见 php 问题的变体，似乎违背了解决方案（和常识）：当用户在我的网站上在 http 和 https 之间切换时，php 会转储会话的内容。这已经够糟糕的了，除了当我在域 test.mysite.com 下运行该网站时该网站运行良好这一事实之外。仅当我在 www.mydomain.com 下运行它并且仅在我们的新服务器上运行时，该问题才会出现。该代码在我的旧机器上运行得很好！
两台服务器都运行 CentOS，其中麻烦的一台运行在 Rackspace CloudServer 上。
有什么建议吗？
编辑
只是为了让事情变得更清楚：当进入安全页面时，会话实际上被清除。即使会话 ID 没有更改，我也无法返回到不安全的页面来查看会话的原始内容。
This is a variant of a common php problem that seems to defy solution (and common sense): when a user switches between http and https on my site, php dumps the contents of the session. This would be bad enough, except for the fact that the site works fine when I run it under the domain test.mysite.com. The problem only shows up when I run it under www.mydomain.com, and only on our new server. The code worked just fine on my old machine!
Both servers are running CentOS, with the troublesome one on Rackspace CloudServer.
Any suggestions?
Edit
Just to make something clearer: the session actually gets cleared when going to a secure page. I can't go back to an unsecured page to view the original contents of the session, even though the session id's haven't changed.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
听起来您已经成为可怕的 php.ini 文件诅咒的受害者。一些 cookie 参数的设置有所不同。
我会确保开发和生产中的 php.ini 文件完全相同，您运行的是相同版本的 PHP，最好是相同的构建。
编辑：好的，所以这不一定是 php.ini 中的差异。
查看您用于 cookie 的域。如果您设置 cookie 时未显式设置域，则它只是当前域。
如果这是 www.example.com，则访问 http://example.com/ 的用户将被重定向到 https://www.example.com/ 将丢失其 Cookie。
为什么？因为 cookie 是为确切的域设置的，并且浏览器不会将其发送到不同的主机名。
如果您以多个名称运行该网站，情况也是如此。确保您仅使用一个名称运行该网站。如果用户使用任何其他名称，请在设置任何 cookie 之前将其永久重定向到 One True Name。
Sounds like you've fallen victim to the curse of the dreaded php.ini file. Some cookie parameters are getting set differently.
I would ensure that the php.ini files in development and production are EXACTLY the same, you are running the same version of PHP, ideally the same build.
EDIT: ok, so it's not necessarily a difference in php.ini.
Have a look at the domain you're using for your cookies. If you set a cookie without explicitly setting the domain, it is the current domain only.
If this is www.example.com, users who visit http://example.com/ then are redirected to https://www.example.com/ WILL LOSE THEIR COOKIES.
Why? Because the cookie is being set for the exact domain, and won't be sent by the browser to a different host name.
The same is true if you run the site on multiple names. Be sure that you only run the site on exactly one name. If a user arrives on any other name, redirect them with a permanent redirect to the One True Name, before setting any cookies.
您可以尝试使用此函数将
secure标志设置为 false 吗？更多信息请参见：https://www.php。 net/manual/en/function.session-get-cookie-params.php
Can you try setting the
secureflag to false using this function?More info here: https://www.php.net/manual/en/function.session-get-cookie-params.php