Passing session variables with cookies turned off - php

Question

I am trying to pass session variable across the two pages I created. Cookies are turned off on my browser (firefox latest version), but I am getting an error. Here is my code
index.php
<?php
session_start();
$_SESSION['name'] = "bob";
?>
<p>
go to next page click here.
</p>
session.php
<?php
session_start();
echo $_SESSION['name'];
?>
PHP cannot recognize the $_SESSION['name'] index and output the following error
Notice: Undefined index: name in C:\xampp\htdocs\S2\session.php on line 3
Note: I have enabled the trans_sid on the php.ini file session.use_trans_sid=1

Answer 1

I recreated your scenario and what worked for me was putting these settings before the session_start():
ini_set("session.use_cookies", 0);
ini_set("session.use_only_cookies", 0);
ini_set("session.use_trans_sid", 1); // well you can leave this since you have it already in php.ini
ini_set("session.cache_limiter", "");
I hope this solves your problem. Of course you can edit your php.ini too instead of hardcoding this.
What I like to add is that using trans_sid can create a security hole if someone gets your session id. Do some IP check before and limit access to only the IP that created the session id. Keep in mind that using trans_id can also break your app if using an old link with old session id.
Link: https://stackoverflow.com/a/3740866/6622577

Answer 2

One should definitely heed caution that passing around session ids in URLs is a security risk and definitely not advisable.
When setting session.use_trans_sid to true, which is what populates the SID constant, you also need to set session.use_only_cookies to false, otherwise PHP looks for the cookie first.
Reference:
session.use_trans_sid is actually a PHP 4 feature that, when used with a PHP build that had the --enable-trans-sid compile time flag, would transparently populate your relative URLs with the SID constant.
From the manual
PHP is capable of transforming links transparently. Unless you are using PHP 4.2.0 or later, you need to enable it manually when building PHP. Under Unix, pass --enable-trans-sid to configure. If this build option and the run-time option session.use_trans_sid are enabled, relative URIs will be changed to contain the session id automatically.
Also
Note: URL based session management has additional security risks compared to cookie based session management. Users may send a URL that contains an active session ID to their friends by email or users may save a URL that contains a session ID to their bookmarks and access your site with the same session ID always, for example.