I have made another Session Library, because of the need for a project. It would be great if you give me some thoughts about it.

Details: http://codeigniter.com/wiki/EckoSession/

Regards

Carnalito

it works or not because on the wiki i see “!!!! Please don’t use this class, i am working on it !!!!” ?

Hi Folks,

did some bugfixing and changed the version to 1.0.1

It is worth a try.

Regards

Carnalito

That is a definite security improvement. Is this basically a fully compatible drop-in replacement that moves the data from browser to database?

I’m not so keen on the way you create your security key though. It seems to be created from a static string and then use only a few bits of pretty common $_SERVER data. I would rather see it using the encryption_key from codeigniter and a random salt, mixed in with that data if you wish.

Also, will this data be cached?

Another thing, how well do you handle mismatches of sessions/cookie/database?

I have implemented something like this at work to allow login integration between a CMS and our online trading systems and I had to find a way to keep the cookie refreshed while the user was looking around either site even when not requesting any session data.

I also had to make sure the database record was replaced if the cookie existed while the database record didn’t, will your library do this?

Hi Phil,

Phil Sturgeon - 26 June 2009 11:46 AM

That is a definite security improvement. Is this basically a fully compatible drop-in replacement that moves the data from browser to database?

i am using this as a fully drop-in replacement in my app. As you can see i am currently in a phase wich i am open to improvements

Phil Sturgeon - 26 June 2009 11:46 AM

I’m not so keen on the way you create your security key though. It seems to be created from a static string and then use only a few bits of pretty common $_SERVER data. I would rather see it using the encryption_key from codeigniter and a random salt, mixed in with that data if you wish.

the security key is needed just for not saving the tokens of this user in plaintext. Other session-libs are saving the useragent in plaintext. I think there is no need to get more encrypting. Maby i don’t get the point!?

Phil Sturgeon - 26 June 2009 11:46 AM

Also, will this data be cached?

What do you mean exactly with: “will this data be cached”? Any examples?

Phil Sturgeon - 26 June 2009 11:50 AM

Another thing, how well do you handle mismatches of sessions/cookie/database? I have implemented something like this at work to allow login integration between a CMS and our online trading systems and I had to find a way to keep the cookie refreshed while the user was looking around either site even when not requesting any session data. I also had to make sure the database record was replaced if the cookie existed while the database record didn’t, will your library do this?

Because the library is based on the native PHP-session-management, there is (as far as i know) no need in handling such issues because PHP itself does.
If the session in the database does not mach the cookie, the session will be started with the session-id of the cookie, if the cookie does not match the database, the cookie will be updated.

Regards

Carnalito

Hi Folks,

removed a typo and uploaded version to 1.0.2

Regards

Carnalito

Is anyone still developing this library?
I’ve found a problem where the session_data would be lost when I’m using IE. It seems to happen when an AJAX request is made.

Has anyone encountered this problem?

Hi,
what exactly do you do when this happens?!
carnalito

I tested it and it seems to happen on IE8 (I haven’t tried other IE versions) only. It works fine on Safari and Firefox (presumably Chrome too).

The page runs a jquery ajax call on load, if I take out the jquery ajax call, it works fine, the session data stays in the database. Once I have the ajax call in the page, the session data seems to get lost.

If you want me to debug it, let me know where I should put the debug statements.

What about the session-id, is it included in your ajax-request?!

No it’s not. Do I just include it as another POST parameter? Does it need to be a specific name?

yes, it is just another post parameter. The name is whatever you set it in php-ini - just check your config.

Sounds pretty good. But before i read your code, i need to know what you actually done with this library. Is it not available in CI Session library or you made the simple one?

Please write the feature of your library.

Thanks.

New URL: https://github.com/EllisLab/CodeIgniter/wiki/EckoSession