Lost PHP sessions with Internet Explorer and Lighttpd webserver - php

Question

I'm having trouble with PHP sessions with IE11 and Edge (Windows 10) connecting to a Lighttpd web-server.
Consider this code:
if (PHP_SESSION_NONE === session_status()) {
session_start();
}
$x = isset($_SESSION['bob'])? $_SESSION['bob'] : 'nothing';
echo 'The Session has started, bob is set to ' . $x .'<br/>';
$_SESSION['bob'] = 'hope';
echo 'The Session ID is ' . session_id() .'<br/>';
When I browse to test.php - containing the above code - using Chrome, shut down Chrome, reopen Chrome, and then browse back to this page it displays:
The Session has started, bob is set to hope
The Session ID is 6d2jbpmrrlrqt96h2nd19ua160
IE11 and Edge will however display:
The Session has started, bob is set to nothing
The Session ID is 35k87vgdt7t41q4lkphq815hq1
Why are IE11 and Edge dropping the session?
**This problem is also happening on WAMP Apache, so although I've seen references to Lighttpd being a potential cause (Internet Explorer, jQuery, session lost php, ) I'm not convinced.
** Also, Fiddler shows a new session ID with each IE\Edge connection.
Any thoughts?

Answer 1

Adding a cookie lifetime to the session using session_set_cookie_params like:
if (PHP_SESSION_NONE === session_status()) {
session_set_cookie_params(60*60*24*7);
session_start();
}
solves the problem: the session persists after the browser is closed and reopened.
The php documentation http://php.net/manual/en/session.configuration.php#ini.session.cookie-lifetime states:
session.cookie_lifetime specifies the lifetime of the cookie in seconds which is sent to the browser. The value 0 means "until the browser is closed." Defaults to
http://php.net/manual/en/function.session-set-cookie-params.php
Which raises the question of why it works in Chrome (45.0.2454.101 m)? But that's another question...
Footnote: Although the max lifetime value for a session cookie would appear to be 2,147,483,647 the max value for "session.gc_maxlifetime" seems to be 65535; and setting lifetime to larger values stopped my sessions from working.