Why does drupal_session_start() fail after a user clears the cache and logs back in?

Question

I'm writing a document management module which has come pretty far and is almost ready for a final review and release, but I've found a really strange authentication issue that is requiring a gross work around.

Several actions in my module are handled via AJAX. I need to authenticate my user when I run the AJAX protocol. I also need to get the Drupal core functionality so I'm using the following code.

// Bootstrap Drupal.
define('DRUPAL_ROOT', dirname(dirname(dirname(dirname(dirname(__FILE__))))));
require_once( DRUPAL_ROOT . '/includes/bootstrap.inc');
drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);

// Validate the user.
_drupal_session_read($_POST['sid']);
drupal_session_start();
if (!user_access('manage documents')) {
  die('Access denied');
}

$_POST['sid'] contains the value from session_id() or from $user->sid. They should be the same thing, but if I clear my cache, log back in, go to the page, and run any AJAX action, I get a 403 error on the first request, every time. My ugly work-around is to send a "checkin" action that just triggers the 403 error, since that is returned only once.

Can anyone explain to me why this code would behave this way?

Answer 1

Upon closer inspection, I've found that the AJAX call is actually creating a new session. This means that I wind up with two session cookies for the site. How can I make Drupal recover the existing session instead?

If you have two sessions, you apparently have two cookies. They may hold the same session ID (and return the same data for $_SESSION). The difference between the cookies is the cookie name.

The name of the cookie is generated from some rather tricky code. (In Drupal 7, it's in drupal_settings_initialize()). it relies on $base_url and $cookie_domain, which are globals. it does some magic and then calls hash('sha256', $session_name) to create the session name, which is the cookie name.

If you get different values for $base_url or $cookie_domain in your AJAX calls, you may end up with two different cookies. For example, one of the AJAX callbacks might be called on ajax.yourdomain.com, while the domain for the site is website.yourdomain.com. It shouldn't be a problem either; the cookie value is what matters. If the cookies have the same value, you don't have a new session.