digitalhuman's avatar

Sessions in 5.1 Regenerates on every refresh/redirect

I'm still stuck at this point. Sessions are not kept but regenerated every time the browser refreshes or redirects. I tested on my 'localhost' with php artisan serve and on my server (with a domain name) running nginx and both show the same issues. Another note is that laravel doesn't seem to pickup my settings in .env for session nor in config/session.php. I can enter whatever I want, nothing changes or happens.

I cleared the cache, i clear config cache.

Below you find my session config:

return [

/*
|--------------------------------------------------------------------------
| Default Session Driver
|--------------------------------------------------------------------------
|
| This option controls the default session "driver" that will be used on
| requests. By default, we will use the lightweight native driver but
| you may specify any of the other wonderful drivers provided here.
|
| Supported: "file", "cookie", "database", "apc",
|            "memcached", "redis", "array"
|
*/

'driver' => "database",

/*
|--------------------------------------------------------------------------
| Session Lifetime
|--------------------------------------------------------------------------
|
| Here you may specify the number of minutes that you wish the session
| to be allowed to remain idle before it expires. If you want them
| to immediately expire on the browser closing, set that option.
|
*/

'lifetime' => 1200,

'expire_on_close' => false,

/*
|--------------------------------------------------------------------------
| Session Encryption
|--------------------------------------------------------------------------
|
| This option allows you to easily specify that all of your session data
| should be encrypted before it is stored. All encryption will be run
| automatically by Laravel and you can use the Session like normal.
|
*/

'encrypt' => true,

/*
|--------------------------------------------------------------------------
| Session File Location
|--------------------------------------------------------------------------
|
| When using the native session driver, we need a location where session
| files may be stored. A default has been set for you but a different
| location may be specified. This is only needed for file sessions.
|
*/

'files' => storage_path('framework/sessions'),

/*
|--------------------------------------------------------------------------
| Session Database Connection
|--------------------------------------------------------------------------
|
| When using the "database" or "redis" session drivers, you may specify a
| connection that should be used to manage these sessions. This should
| correspond to a connection in your database configuration options.
|
*/

'connection' => "mysql",

/*
|--------------------------------------------------------------------------
| Session Database Table
|--------------------------------------------------------------------------
|
| When using the "database" session driver, you may specify the table we
| should use to manage the sessions. Of course, a sensible default is
| provided for you; however, you are free to change this as needed.
|
*/

'table' => 'sessions',

/*
|--------------------------------------------------------------------------
| Session Sweeping Lottery
|--------------------------------------------------------------------------
|
| Some session drivers must manually sweep their storage location to get
| rid of old sessions from storage. Here are the chances that it will
| happen on a given request. By default, the odds are 2 out of 100.
|
*/

'lottery' => [2, 100],

/*
|--------------------------------------------------------------------------
| Session Cookie Name
|--------------------------------------------------------------------------
|
| Here you may change the name of the cookie used to identify a session
| instance by ID. The name specified here will get used every time a
| new session cookie is created by the framework for every driver.
|
*/

'cookie' => 'euroid_session',

/*
|--------------------------------------------------------------------------
| Session Cookie Path
|--------------------------------------------------------------------------
|
| The session cookie path determines the path for which the cookie will
| be regarded as available. Typically, this will be the root path of
| your application but you are free to change this when necessary.
|
*/

'path' => '/',

/*
|--------------------------------------------------------------------------
| Session Cookie Domain
|--------------------------------------------------------------------------
|
| Here you may change the domain of the cookie used to identify a session
| in your application. This will determine which domains the cookie is
| available to in your application. A sensible default has been set.
|
*/

'domain' => env('SESSION_COOKIE_DOMAIN', null),

/*
|--------------------------------------------------------------------------
| HTTPS Only Cookies
|--------------------------------------------------------------------------
|
| By setting this option to true, session cookies will only be sent back
| to the server if the browser has a HTTPS connection. This will keep
| the cookie from being sent to you if it can not be done securely.
|
*/

'secure' => false,

];

0 likes
15 replies
elit-internet's avatar

Well, as I originally stated in my original comment at https://github.com/laravel/framework/issues/8172#issuecomment-103019015 :

Value 'domain' inside session.php file must be set correctly. I set it the same value as my fake real-looking domain - in my case basis.audith.org - and session is working now. Setting that value as localhost and accessing the app from localhost domain does NOT work in Chrome (as per aforementioned reason: cookies are not designed for TLDs, but for second-level-domains and below; and Chrome follows that rule), but works in Firefox. Setting it to audith.basis (fake domain I used for my project in general) works as well.

To those who work with Socialite, be warned: since Twitter doesn't accept localhost and G+ doesn't accept unreal domains like audith.basis in callback-URIs, you should be working with real-looking domains to avoid all these problems altogether.

bashy's avatar

Check with cURL. First request the page so you can get the cookie value. Then you can send that cookie and get the current token.

There's no reason it should be regenerating unless there's some cookies being erased on each request.

digitalhuman's avatar

Nothing happens, not in Chrome not in Firefox. Not local, not remote with an actual domain. Session still keeps regenerated.

elit-internet's avatar

Yes, but have you entered the real domain into config file? Do you have SESSION_COOKIE_DOMAIN=.... line in your .env file with real domain name in there?

bashy's avatar

Nothing happens? What's that meant to mean?

digitalhuman's avatar

No cookie get's created, no session that keeps remembered, i don't get the feeling session is even started/used.

digitalhuman's avatar

To be clear, i have changed session.php to the version below and i am testing on FF now. Since 'Chrome' has issues according to some. And i am running locally

return [

/*
|--------------------------------------------------------------------------
| Default Session Driver
|--------------------------------------------------------------------------
|
| This option controls the default session "driver" that will be used on
| requests. By default, we will use the lightweight native driver but
| you may specify any of the other wonderful drivers provided here.
|
| Supported: "file", "cookie", "database", "apc",
|            "memcached", "redis", "array"
|
*/

'driver' => "cookie",

/*
|--------------------------------------------------------------------------
| Session Lifetime
|--------------------------------------------------------------------------
|
| Here you may specify the number of minutes that you wish the session
| to be allowed to remain idle before it expires. If you want them
| to immediately expire on the browser closing, set that option.
|
*/

'lifetime' => 1200,

'expire_on_close' => false,

/*
|--------------------------------------------------------------------------
| Session Encryption
|--------------------------------------------------------------------------
|
| This option allows you to easily specify that all of your session data
| should be encrypted before it is stored. All encryption will be run
| automatically by Laravel and you can use the Session like normal.
|
*/

'encrypt' => false,

/*
|--------------------------------------------------------------------------
| Session File Location
|--------------------------------------------------------------------------
|
| When using the native session driver, we need a location where session
| files may be stored. A default has been set for you but a different
| location may be specified. This is only needed for file sessions.
|
*/

'files' => storage_path('framework/sessions'),

/*
|--------------------------------------------------------------------------
| Session Database Connection
|--------------------------------------------------------------------------
|
| When using the "database" or "redis" session drivers, you may specify a
| connection that should be used to manage these sessions. This should
| correspond to a connection in your database configuration options.
|
*/

'connection' => null,

/*
|--------------------------------------------------------------------------
| Session Database Table
|--------------------------------------------------------------------------
|
| When using the "database" session driver, you may specify the table we
| should use to manage the sessions. Of course, a sensible default is
| provided for you; however, you are free to change this as needed.
|
*/

'table' => 'sessions',

/*
|--------------------------------------------------------------------------
| Session Sweeping Lottery
|--------------------------------------------------------------------------
|
| Some session drivers must manually sweep their storage location to get
| rid of old sessions from storage. Here are the chances that it will
| happen on a given request. By default, the odds are 2 out of 100.
|
*/

'lottery' => [2, 100],

/*
|--------------------------------------------------------------------------
| Session Cookie Name
|--------------------------------------------------------------------------
|
| Here you may change the name of the cookie used to identify a session
| instance by ID. The name specified here will get used every time a
| new session cookie is created by the framework for every driver.
|
*/

'cookie' => 'euroid_session',

/*
|--------------------------------------------------------------------------
| Session Cookie Path
|--------------------------------------------------------------------------
|
| The session cookie path determines the path for which the cookie will
| be regarded as available. Typically, this will be the root path of
| your application but you are free to change this when necessary.
|
*/

'path' => '/',

/*
|--------------------------------------------------------------------------
| Session Cookie Domain
|--------------------------------------------------------------------------
|
| Here you may change the domain of the cookie used to identify a session
| in your application. This will determine which domains the cookie is
| available to in your application. A sensible default has been set.
|
*/

'domain' => "audit.basic",

/*
|--------------------------------------------------------------------------
| HTTPS Only Cookies
|--------------------------------------------------------------------------
|
| By setting this option to true, session cookies will only be sent back
| to the server if the browser has a HTTPS connection. This will keep
| the cookie from being sent to you if it can not be done securely.
|
*/

'secure' => false,

];

bashy's avatar

5.1 works fine for me without changing anything to do with cookie domain since it uses the current one anyway.

digitalhuman's avatar

I never checked if sessions where working until i was implementing Socialite. Which loads and loads of users are having issues. Which might be causing the issues?................ just something that is poping up in my head as I am writing.

digitalhuman's avatar

As you can imagine I can not do anything now because I need sessions.............................. :(

elit-internet's avatar

@digitalhuman , I believe you didn't understand my original post above. Don't put wrong domain in there (audit.basis). Please read it again and put correct, working domain there. Then access your site with that domain. Do you understand?

digitalhuman's avatar

Yes I get that, i have put that fake domain in there to test. I changed it to 'localhost', to my real domain name and to null. Doesn't make any difference. The outcome is still the same. What do you suggest i set this value to when i'm testing on 'localhost' ?

digitalhuman's avatar

Oke starting from scratch. This bug most be hiding somewhere. I just cloned the Laravel project yesterday. Installed Gulp, Elixer and then Socialite. So it must be somewhere. I'll keep you posted.

elit-internet's avatar

@digitalhuman you are still doing it wrong: you still telling me as domain name you have put "localhost", "audit.basis", null ALL OF WHICH are wrong and not real domain names. You have to work with REAL domain names, like example.com (TLD must be real - know what TLD is? TLD = top level domain. in "example.com", ".com" part is top-level-domain [TLD], ".example" part is second-level-domain). REAL domain = the one with REAL TLD. So, again, put some real domain name when you are working with Socialite.

techtrav's avatar

Did anyone solve this issue? I can't get the oauth_temp cookie to set when using Socialite!

Please or to participate in this conversation.