# session_start and set-cookie woes

- Thread: https://externals.io/message/22664
- Original archive: https://news-web.php.net/php.internals/22664
- Started by Ralph Schindler on 2006-04-04T20:21:22+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #22664 — Ralph Schindler — 2006-04-04T20:21:22+00:00

URL: https://externals.io/message/22664#22664

Is there any reason why session_start should be sending a new
Set-Cookie: name=id on each and every session_start call?  It seems to
me the original functionality of this function would only send a
set-cookie if a valid session didn't already existed and/or was not 
provided by the client.

These are the changes I believe broke the original functionality of
sending a set-cookie header only when needed:

http://cvs.php.net/viewcvs.cgi/php-src/ext/session/session.c?r1=1.353&r2=1.354

take a look at

line 1184 on the left
if (PS(send_cookie)) {
      php_session_send_cookie(TSRMLS_C);
}

turned into

php_session_reset_id(TSRMLS_C);

php_session_reset_id() auto calls the send cookie routine.

should this be default behavior?


To demonstrate the issue I have made a sample script called simpletest.php
--------------------------------------------------
<?
 `session_start()`;
?>





Here are the request and response headers from 2 calls to the simpletest 
script.
--------------------------------------------------
http://10.20.1.2/tests/sessions/simpletest.php

GET /tests/sessions/simpletest.php HTTP/1.1
Host: 10.20.1.2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) 
Gecko/20060111 Firefox/1.5.0.1
Accept: 
text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://10.20.1.2/tests/sessions/
Cache-Control: max-age=0

HTTP/1.x 200 OK
Date: Tue, 04 Apr 2006 18:58:15 GMT
Server: Apache
X-Powered-By: PHP/5.1.1-gentoo
Set-Cookie: PHPSESSID=679449c50fd155c96311bfac50bcec5a; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, 
pre-check=0
Pragma: no-cache
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=ISO-8859-1
----------------------------------------------------------
http://10.20.1.2/tests/sessions/simpletest.php

GET /tests/sessions/simpletest.php HTTP/1.1
Host: 10.20.1.2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) 
Gecko/20060111 Firefox/1.5.0.1
Accept: 
text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://10.20.1.2/tests/sessions/
Cookie: PHPSESSID=679449c50fd155c96311bfac50bcec5a
Cache-Control: max-age=0

HTTP/1.x 200 OK
Date: Tue, 04 Apr 2006 18:58:19 GMT
Server: Apache
X-Powered-By: PHP/5.1.1-gentoo
Set-Cookie: PHPSESSID=679449c50fd155c96311bfac50bcec5a; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, 
pre-check=0
Pragma: no-cache
Content-Length: 0
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=ISO-8859-1