My code is dropping all PHP sessions after logging - php

Question

Once my users log in and verify themselves I am sending my adimninstrators to an activity page. This inital page shows session values when I dump the sessions. However when I move to any other page in my site I lose the session values.
I am setting my pages by including the classes in the header file. I calling session start (if (session_id() === "") { session_start(); }) at the top of each file in the site. I have nothing within my code that will cause my session to be destroyed.
when the user is being authenticated, i am using this snippet of PHP
<?php require_once('includes/init.php'); ?>
<?php
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
if (isset($_POST['login'])) {
require 'auth_login.php';
} elseif (isset($_POST['register'])) {
require 'register.php';
}
}
?>
when they submit the form, they are sent to auth_login, and the successful login/verification code looks like this:
if ($_POST['code'] == $users->auth_code) {
$_SESSION['logged_in'] = 'true';
$_SESSION['id'] = $users->id;
redirect("/admin/activity.php");
}
This is the content of my init file:
if (session_id() === "") { session_start(); }
error_reporting(E_ALL);
ini_set('display_errors', 1);
require_once("functions.php");
require_once("config.php");
require_once("database.php");
require_once("db_object.php");
My functions file:
<?php
function classAutoLoader($class){
$class = strtolower($class);
$the_path = "includes/{$class}.php";
if(is_file($the_path) && !class_exists($class)){
require_once($the_path);
} else {
die ("File, {$class} does not exist");
}
}
spl_autoload_register('classAutoLoader');
function redirect($location){
header("Location:{$location}");
}
?>
My config file:
<?php
define('DB_HOST', 'XXX');
define('DB_USER', 'XXX');
define('DB_PASS', 'XXX');
define('DB_NAME', 'XXX');
?>
My database class
class Database{
public $connection;
function __construct(){
$this->open_db_connection();
}
public function open_db_connection(){
$this->connection = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
if ($this->connection->connect_errno){
die("Database connection failed ". $this->connection->connect_errno);
}
}
public function query($sql){
$result = $this->connection->query($sql);
$this->confirm_query($result);
return $result;
}
private function confirm_query($result){
if (!$result){
die("Query Failed". $this->connection->error);
}
}
public function escape_string($string){
$escaped_string = $this->connection->real_escape_string($string);
return $escaped_string;
}
public function the_insert_id(){
return $this->connection->insert_id;
}
}
$database = new Database();
When my user lands on activity.php, i am using these 2 snippets
echo '<pre>';
var_dump(session_status());
echo '</pre>';
echo '<pre>';
var_dump($_SESSION);
echo '</pre>';
There I get my 2 values in the session dump and I get int(2) session status. When i hit any other page in my directory I lose the sessions in the dump, but i still see a int(2) for my status.
I am leaning towards thinking that my issue exist within the htaccess file.
RewriteEngine On
RewriteCond %{SCRIPT_FILENAME} !-d
RewriteCond %{SCRIPT_FILENAME} !-f
RewriteCond %{REQUEST_URI} !^/(admin|processes|paypal-ipn/)$
RewriteRule ^.*$ ./index.php
All traffic except a directory is having the file extensions striped. Could that be what is causing my problem.
Thanks in advance.

Answer 1

Work In Progress:
I'm afraid I'm going to have to go, but we have proven that the session saves correctly and can be read from the same file, as is written to. So if the other files are in another folder then there may be some folder specific PHP.ini settings messing up the session reading? I think the issue does appear to be outside the scope of what you've put in your question, but that is not to place blame, simply that it's more complex to establish what's going on.
I have nothing within my code that will cause my session to be destroyed.
Then this means that sessions are not being started, so the session data is unavailable to PHP.
I do have session start at the top of my init file.
So the next step is to var_dump($_SESSION); immediately after you start the session, like so:
session_start();
error_reporting(E_ALL);
ini_set('display_errors', 1);
var_dump($_SESSION);
require_once("functions.php");
...
And let us know what this outputs? Are the sessions empty or are they full of stuff at the point of time the page loads?
I do not know how to access the sessions directory on my server
You need to load the phpinfo or the php.ini file and see where it says:
session.savepath . This is where sessions are stored. Once you know this you can open that folder, and find the session file, usually sess_<session_id value> and see if any data is being written to the session.
Update 3:
Please try this adjusted code:
if ($_POST['code'] == $users->auth_code) {
$_SESSION['logged_in'] = 'true';
$_SESSION['id'] = $users->id;
session_write_close();
session_start();
error_log(print_r($_SESSION,true));
redirect("/admin/activity.php");
This will write to the session, close the session and then open the session and save the contents to the Error Log file. You should be using error logs far more than screen displays.
Result:
The error log shows me this. [02-Aug-2019 21:10:50 UTC] Array ( [logged_in] => true [id] => 1 ) [02-Aug-2019 21:10:50 UTC] PHP Notice: Undefined index: email in /home/linepickleadmin/public_html/admin/auth_verify.php on line 34