Propagate session state in IFrame

[neptun_]

Hi,

I am using a page with an iframe within it.
When I am loading the first time the page, I change the session name. The problem is that I do not know how to pass the new session name also to the IFrame.

The beginning of the code for the page is:

	global $session_name;
	
	if (isset($_REQUEST['session_name'])) {
		// use session name passed via $_GET or $_POST
		$session_name = $_REQUEST['session_name'];
	} // if		
	
	// get details from any previous session
	if (isset($session_name)) {
		// use existing session name
	} else {
		// assign new session name
		$session_name = getNewSession('session');
	} // if
	
	session_name($session_name);
	session_start();
	
	

	echo ">" . $session_name;
	
	function getNewSession ($prefix = 'session')
	// create a new session name using $prefix + a number.
	{
    // step through numbers 0-99
    for ($i = 0; $i <= 1000; $i++) {
        $session_name = $prefix .$i;
        if (!array_key_exists($session_name, $_COOKIE)) {
            break;
        } // if
    } // if
    
    return $session_name;

	} // getNewSession

The beginning of the code for the IFrame is:

	session_start();	
	
	echo ">>" . session_name();

For the page, the output is : >session0
For the IFrame the output is : >>PHPSESSID

The conclusion is that, in this case, the IFrame doesn’t know about the session name of the parent page.
Could you suggest me an idea on how to make them work together, by using the same session name?

Thanks

[visualAd]

It is quite probable that the iFrame page is being requested at the same time as the parent page. The session state is not saved until the script has finished, hence you are not seen the update. Its a classic race condition.

I suggest that you load the page with the iframe location set to "about:blank" and change the location when the page has loaded fully. This will however require Javascript.

[neptun_]

I have followed your advice, by loading a blanc page in the iFrame, and then changing the location of the iFrame in the onLoad event of the body tag, after the page has fully loaded.

Unfortunately the result remain the same, with a different session_name() on the two pages.

Anyway, thanks for the advice. By reading it, I also thought that could be a solution.

[visualAd]

You also need to set session_name() before you call session_start() in the iFrame too. Otherwise it uses the default. I suggest that you check the session name contains no invalid characters too and limit the number of sessions that can exist per user as it would be very easy to flood the server with files if you do not.

[neptun_]

A solution I found is to pass the session name in the address of the iframe, and it works.