Session values get overwritten when multiple users access in YII - php

Question

I am working on 'Forgot Password' functionality using YII framework. The flow is as such -->
At the Login Page , a Link 'Forgot Password' is provided. On clicking it, a new view is rendered where the user needs to put his EMail Address . A mail is delivered to the Mail ID and a link is provided in that mail on clicking of which the User will be taken to 'RESET Password' PAge where he can SET a new password.
I am working with Sessions for fulfilling this scenario.The issue is that Session is being overwritten and only the latest entered EMAIL Address(User) can RESET the password (when tried by entering Multiple EMAIL ID's one after other).
1)Firstly I have started the session after the 'Submit Button' is clicked.A random string is kept in the session and send to the EMAIL . When User Clicks on the reset link , the RESET page is opened and if the string matches with the Session String then the Password can be reset .
All these works fine if worked with only one EMAil . if i enter two Email ID's .. I get the mail on Both with reset link generated ,,,, but when I click on the reset link of first Mail ID ,,, i get Error messsage where as when i click the reset link received in second MAil Address ,, then it works .
public function actionForgotPassword()
{
$model = new ForgotPasswordForm;
$userModel = new UserDetails;
if(isset($_POST['ForgotPasswordForm']))
{
$model->attributes = $_POST['ForgotPasswordForm'];
// validate user input and redirect to the previous page if valid
if($model->validate())
{
$getMail = $_POST['ForgotPasswordForm']['email'];
$user = UserDetails::model()->findByAttributes(array(
'email' => $getMail
));
if($user)
{
session_start();
$sessionString = $model-> genRandomSaltString();
Yii::app()->session['identityString'] = $sessionString;
///Below is the MAIL function
}
}}}
The Code on RESET PAge is
public function actionNewPassword()
{
session_start();
$model = new ChangePasswordForm;
$userModel = new UserDetails;
$email = Yii::app()->request->getParam('tag');
$getSessionKey = Yii::app()->request->getParam('key');
//print_r($_SESSION);die;
$catchSessionValue = Yii::app()->session['identityString'];
if(!empty($_SESSION) && !empty($catchSessionValue))
{
if($catchSessionValue == $getSessionKey && $email !== null)
{
$user_arr = UserDetails::model()->findByAttributes(array('email' => $email));
$user_name = $user_arr['username'];
$user_id = $user_arr['id'];
Yii::app()->user->setFlash('info', "Enter your New Password here.");
if(isset($_POST['ChangePasswordForm']))
{
$this->render('changepassword',array('change_pw_form'=>$model,'user'=>$user_arr));
}
else{
$this->render('changepassword',array('change_pw_form'=>$model,'user'=>$user_arr));
}
}
else
{
Yii::app()->user->setFlash('error', "Something went Wrong. Try Again!");
$this->render('changepassword');
//$this->redirect(Yii::app()->createUrl('site/login'));
}
}
else
{
$user_arr = UserDetails::model()->findByAttributes(array('email' => $email));
Yii::app()->user->setFlash('error', "Sorry ! The link has been expired. Please try again.");
$this->render('changepassword',array('change_pw_form'=>$model,'user'=>$user_arr));
// $this->redirect(Yii::app()->createUrl('site/login'));
}
}

Answer 1

You're overriding the value over and over again and hence only the last email's 'identityString' is being stored.
Why?
For the same 'browser session' (meaning you didn't close the browser or open the page in a different browser), a session remains the same. (Unless explicitly destroyed in your php code)
And as long as the session remains the same, you are effectively overriding the 'identityString' session value each time. Meaning, the random string generated while sending the first mail is overridden by the random string generated while sending the second mail. That is why you are not getting the error in the second one.
Sessions are not useful in this case, because the values you are storing are not accessible once the user closes his browser or uses a different browser or a device to click on the link in the mail.
You would store such information in a database, or a cache. If you don't want to use a db, file caches are available in Yii. Use Yii::app()->cache->set($id, $value); Where $id could be a unique string generated from the user's email address and $value is the $sessionString
Example:
$id = 'identityString.'.md5($getEmail);
// 'identityString.9e107d9d372bb6826bd81d3542a419d6'
Yii::app()->cache->set($id, $sessionString);
And you will retrieve this again:
$id = 'identityString.'.md5($email);
$catchSessionValue = Yii::app()->cache->get($id);
And here's a simple explanation of how sessions work:
Whenever a session is initialized on your server, the browser stores a session cookie with a unique value. This cookie is passed around with every request to your server from then. The unique value is used to identify the session, and the server retrieves all the variables initialised for that session.
The browser loses the session cookie when it is closed and hence access to that session is lost.
Also, a fellow stackoverflow user wrote this, go through it:
http://machinesaredigging.com/2013/10/29/how-does-a-web-session-work/