Laravel Session::token keeps changing in every request when not using https:// - php

I have read almost 100+ questions in stackoverflow about this. But nothing helped me.
My problem:
Laravel Session::token is re-generated in each HTTP request when I upload my app in my shared hosting. The app works fine when the domain has https://. But if I load the app using http://, no forms work (shows 419 Page Expired). The app also works fine in my localhost (Windows 10 with apache server) even though it's also http://localhost.
I can simply force to HTTPS using .htaccess to ignore the issue. But I want my app to be functioning in non-SSL domains also.
If I hit https://example.com/ 10 times, dd(Session::token()); returns the same token xZYdXs5UuXUSCZ5wHGELad9GuqjimkrPhMlsMepE every time.
And if I hit http://example.com/ 10 times, dd(Session::token()); returns different random tokens each time.
My Hosting Server: Litespeed
Laravel Version: 6.2
PHP Version: 7.4
.env file
SESSION_DRIVER=file
SESSION_LIFETIME=120
config/session.php file
use Illuminate\Support\Str;
return [
'driver' => env('SESSION_DRIVER', 'file'),
'lifetime' => env('SESSION_LIFETIME', 120),
'expire_on_close' => false,
'encrypt' => false,
'files' => storage_path('framework/sessions'),
'connection' => env('SESSION_CONNECTION', null),
'table' => 'sessions',
'store' => env('SESSION_STORE', null),
'lottery' => [2, 100],
'cookie' => env(
'SESSION_COOKIE',
Str::slug(env('APP_NAME', 'laravel'), '_').'_session'
),
'path' => '/',
'domain' => env('SESSION_DOMAIN', null),
'secure' => env('SESSION_SECURE_COOKIE', false),
'http_only' => true,
'same_site' => null,
];
Permission:
/storage 0755
/storage/framework/sessions 0755
Please let me know if I should share any relevant information to make the issue more clear.
Thank you.

Related

Laravel - how to upload file to another application on localhost?

I'm trying to create a file upload where admin would upload file from admin application to another application for regular users (they are on different domains).
I got it working with FTP filesystem but I would like to test it on localhost, before I fully deploy it.
I made a config entry in filesystem.php:
'ftp' => [
'driver' => 'ftp',
'host' => env('FTP_HOST'),
'username' => env('FTP_USERNAME'),
'password' => env('FTP_PASSWORD'),
'root' => '',
'port' => 21,
'timeout' => 30,
'ssl' => true,
]
And on my test function in admin_app I do this:
Storage::disk('ftp')->put('/public_app/storage/test3.png', $file);
I have to separate laravel applications: admin_app and public_app. How could I test the same thing on localhost? Another config entry point or do I need to download FTP for localhost?
What about using something like remote server that contain your assets?
For example use S3 and upload all your files there and access it from your second app or any other app.
Check this Article

Laravel 4.2 behind ELB - Sessions not working

I'm running Laravel 4.2 with database session storage.
My application is running behind a Load Balancer.
When only one instance is running, my application works fine.
Then if i enable a second instance my application stops working.
My application adds a session to the database on almost every pageload, and i can't write/read sessions (and can't login).
Here is my session config
return array(
'driver' => 'database',
'lifetime' => 1440,
'expire_on_close' => false,
'files' => storage_path().'/sessions',
'connection' => "mysql",
'table' => 'sessions',
'lottery' => array(2, 100),
'cookie' => 'ycrm_session',
'path' => '/',
'domain' => null,
'secure' => false,
);
My sessions table looks like this
Have anybody experied that issue before?
I found the problem.
I'm using forge to manage and deploy my application. When i deploy my code its running composer install and its seems to edit my config/app.php .
I just redeployed my config/app.php and its starts working.

How to clear redis cache while keeping session data : Laravel 5

I am using redis as a session driver and I want to clear the cache while keeping the session data, so basically user can stay logged in. Any suggestions regarding restructuring or handling the current situation?
Note: I don't want to use separate redis instance for sessions and other cache data.
Intro
By default, redis gives you 16 separate databases, but laravel out of the box will try to use database 0 for both sessions and cache.
Our solution is to let Redis caching using database 0, and database 1 for Session, there for solving the session clear by running php artisan cache:clear problem.
1. Setting up Session Redis connection
Modify config/database.php, add session key to the redis option:
'redis' => [
'cluster' => false,
'default' => [
'host' => env('REDIS_HOST', 'localhost'),
'password' => env('REDIS_PASSWORD', null),
'port' => env('REDIS_PORT', 6379),
'database' => 0,
],
'session' => [
'host' => env('REDIS_HOST', 'localhost'),
'password' => env('REDIS_PASSWORD', null),
'port' => env('REDIS_PORT', 6379),
'database' => 1,
],
],
2. Make use of the session connection
Modify config/session.php, change the following:
'connection' => null,
to:
'connection' => 'session',
3. Using Redis as session driver
Modify .env, change SESSION_DRIVER:
SESSION_DRIVER=redis
4. Testing out
Execute the following artisan command, then check your login state:
php artisan cache:clear
If the login state persists, voilĂ !
I don't know Laravel, but in general the best two options would be:
Change the format of the cache keys. You should use versioned cache keys so you can do it in the future, i.e. "cache.1." so you can increment and then it makes all your keys irrelevant at once.
Move the cache to a different db number in the same redis instance. That way you can also later do FLUSHDB on that db number to clear the cache.
In both options, after you first do it, if the cache keys are not time-expiring, you should create a script that uses SCAN to remove old keys. See http://redis.io/commands/scan
As a side note, it's usually a bad idea to keep cache and other things in the same redis instance, as in caches you usually use LRU based eviction, and you don't want to mix that with less volatile keys.
https://laravel.com/docs/5.2/redis#configuration
'redis' => [
'cluster' => false,
'default' => [
'host' => '127.0.0.1',
'port' => 6379,
'database' => 0,
],
],
There is 'database' in redis connection options, just select different databases for session and cache. I just hope that redis cache driver uses flushdb not flushall for flushing :).
Laravel Cache::clear() sends the Redis flushall command which will dump everything so not very useful in my experience. You will need to extend the cache class and create a custom set to index the cache data you want to be able to clear. Then build an another function to read the set and issue Redis del() command for each key in the set. Post some working code and will detail further if necessary
Notagolfers suggestion of separation of cache and session into different redis databases isn't a had call but you will still need to extend the cache class to implement the Redis database config switch
For the laravel 9 (it is similar for an older ones):
1.update session configuration
you must put in .env:
SESSION_CONNECTION=session
that configuration is then loaded at config/session.php
'connection' => env('SESSION_CONNECTION'),
That tells laravel to store sessions in separated redis/database connection
2.update redis configuration
add new redis connection at the config/database.php for sessions
'redis' => [
...
'session' => [
'host' => env('REDIS_HOST', 'localhost'),
'password' => env('REDIS_PASSWORD', null),
'port' => env('REDIS_PORT', 6379),
'database' => 0,
],
...
]
you can use and database number from 0 to 16. For other connections put different database number.
3.clear cache(without touching sessions)
now you can clear the redis cache with this piece of code:
$redisConnection = \Illuminate\Support\Facades\Redis::connection('default');
$redisConnection->flushDB();
TIP: You can put that code in custom command and run it with the artisan
BONUS: You can see and clear all redis data for each connection with:
$redisSession = \Illuminate\Support\Facades\Redis::connection('session');//session|queue|default
$redisSessionKeys = $redisSession->keys('*');
$redisSession->flushDB();
dd($redisSessionKeys);
BONUS2: You can also add "redis database" for queues and then you have queue jobs, sessions and cache separated and you can clear only one of them
'redis' => [
...
'default' => [
'host' => env('REDIS_HOST', 'localhost'),
'password' => env('REDIS_PASSWORD', null),
'port' => env('REDIS_PORT', 6379),
'database' => 0,
],
'session' => [
'host' => env('REDIS_HOST', 'localhost'),
'password' => env('REDIS_PASSWORD', null),
'port' => env('REDIS_PORT', 6379),
'database' => 1,
],
'queue' => [
'host' => env('REDIS_HOST', 'localhost'),
'password' => env('REDIS_PASSWORD', null),
'port' => env('REDIS_PORT', 6379),
'database' => 2,
],
]

Laravel 5 store session in database/redis

I want to use database (currently, MySQL) to store session. But, when I tried to config, table sessions still has no record.
In file config/session.php when I change 'driver' => env('SESSION_DRIVER', 'file'),
to 'driver' => env('SESSION_DRIVER', 'database'),
or 'driver' => env('SESSION_DRIVER', 'redis'),
What should I change for 'connection' => null,?
I tried:
'connection' => 'mysql', with mysql is configured in app/database.php
'connection' => 'database.connections.mysql',
'connection' => Config::get('database.connections.mysql'), got class not found error
All you need to do is specify the right driver in the environment file, and generate the schema as outlined in the documentation.
This line:
'driver' => env('SESSION_DRIVER', 'database')
This is telling the config to get the SESSION_DRIVER variable from your environment file, and use database as a default. I can only assume you have forgotten to update your .env file.
I hade to change SESSION_DRIVER=database in .env file
config/session.php changes didn't work for me

CakePHP cookies are not secure and not httponly

Cookies in my app are not secured and not http only, but they are configured exactly as in example on CakePHP Book 2.0 - Session Configuration.
Configure::write('Session', array(
'defaults' => 'php',
'timeout' => 30,
'cookieTimeout' => 30,
'ini' => array(
'session.cookie_secure' => true,
'session.cookie_httponly' => true
)
));
I am using SSL so this should be done automatically, but it's not happening, not even when I set this manually, see the code above. Cookie timeouts work well.
Any ideas? Thank you very much!
Here you have used default parameter is 'PHP' in this case your application takes timeout of main PHP configuration like from php.ini file. you can set it 'cake' to control your session scope.

Categories