0

I'm writing a document management module which has come pretty far and is almost ready for a final review and release, but I've found a really strange authentication issue that is requiring a gross work around.

Several actions in my module are handled via AJAX. I need to authenticate my user when I run the AJAX protocol. I also need to get the Drupal core functionality so I'm using the following code.

// Bootstrap Drupal.
define('DRUPAL_ROOT', dirname(dirname(dirname(dirname(dirname(__FILE__))))));
require_once( DRUPAL_ROOT . '/includes/bootstrap.inc');
drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);

// Validate the user.
_drupal_session_read($_POST['sid']);
drupal_session_start();
if (!user_access('manage documents')) {
  die('Access denied');
}

$_POST['sid'] contains the value from session_id() or from $user->sid. They should be the same thing, but if I clear my cache, log back in, go to the page, and run any AJAX action, I get a 403 error on the first request, every time. My ugly work-around is to send a "checkin" action that just triggers the 403 error, since that is returned only once.

Can anyone explain to me why this code would behave this way?

4
  • For Drupal 6, the following code will work to get the session value. require_once './includes/bootstrap.inc'; drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL); If you are using Drupal 7 use the built-in AJAX framework.
    – JohnC
    Aug 16, 2012 at 6:48
  • That's exactly the code that I'm using in this example (lines 2 and 3). Like I said, it works most of the time, but if the user clears cache, the very first attempt fails then all others succeed.
    – Chris
    Aug 16, 2012 at 13:38
  • As for the AJAX framework. It appears to be very limiting. I've got working code. I just want the sessions to behave as advertised.
    – Chris
    Aug 16, 2012 at 13:41
  • Upon closer inspection, I've found that the AJAX call is actually creating a new session. This means that I wind up with two session cookies for the site. How can I make Drupal recover the existing session instead?
    – Chris
    Aug 16, 2012 at 19:02

1 Answer 1

0

Upon closer inspection, I've found that the AJAX call is actually creating a new session. This means that I wind up with two session cookies for the site. How can I make Drupal recover the existing session instead?

If you have two sessions, you apparently have two cookies. They may hold the same session ID (and return the same data for $_SESSION). The difference between the cookies is the cookie name.

The name of the cookie is generated from some rather tricky code. (In Drupal 7, it's in drupal_settings_initialize()). it relies on $base_url and $cookie_domain, which are globals. it does some magic and then calls hash('sha256', $session_name) to create the session name, which is the cookie name.

If you get different values for $base_url or $cookie_domain in your AJAX calls, you may end up with two different cookies. For example, one of the AJAX callbacks might be called on ajax.yourdomain.com, while the domain for the site is website.yourdomain.com. It shouldn't be a problem either; the cookie value is what matters. If the cookies have the same value, you don't have a new session.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.