0

I recently implemented a simple PHP login system that has the following logic:

  1. User Submits Form with E-mail & Password
  2. jQuery post request to external PHP file.
  3. PHP file checks username and password,
  4. A.) If login is OK, sets session variable, returns SUCCESS code, which reloads the page (after setting the new session). B.) If login is bad, returns error code.

The problem (not browser specific) is that sometimes (randomly, roughly 1 out of every 2 or 3 times), after a success code has been sent back & the page reloads, the session has NOT been set or changed.

jQuery post request:

 function tryLogin() {
     $.post( "/assets/lib/lib_actions.php?action=login", {email: $(".login-email").val(), passwor$
         if (data == "success") {
             window.location.replace("url to homepage - don't wish to reveal website");
         } else {
             $(".login-alert").css("display", "block");
             $(".login-alert").html(data);
         }       
     });
  }

PHP Login check:

I've tried to fix the problem by inserting the while loop around where the session is set, but still no luck.

 public function login($email, $password) { //will update to prepared statements when done
            $row = self::$db->query("SELECT * FROM members WHERE email='".$email."'");
            if (mysqli_num_rows($row) == 1) {
                    $row = self::$db->fetchArray($row);
                    $savedPassword = $row['password'];
                    $salt = $row['salt'];
                    $hash = crypt($password, $salt);
                    if ($savedPassword == $hash) {
                            while (!isset($_SESSION['uid']) || $_SESSION['uid'] == "Guest") {
                                    session_regenerate_id();
                                    $_SESSION['uid'] = $row['UID'];
                                    session_write_close();
                                    self::$db->query("UPDATE members SET lastActive=now() WHERE UID='".$row['UID$
                            }

                            return "success";
                    }
            }
            return "Incorrect E-mail or Password";
    }

Does this check on every new page load:

 if (isset($_SESSION['uid']) && $_SESSION['uid'] != "Guest") {

I appreciate any help or insights to the problem. I can also post any additional code if requested.

Meneer Venus
  • 1,039
  • 2
  • 12
  • 28
Gosre
  • 61
  • 9
  • Are you displaying all PHP warnings (E_ALL on error reporting)? Possible explanation is that (in some cases) your [headers are already sent](http://stackoverflow.com/questions/8028957/how-to-fix-headers-already-sent-error-in-php) when starting/setting sessions. – Allmighty Nov 13 '14 at 15:50
  • done any basic debugging? like checking the return value of `session_regenerate_id()`? It'll return false on failure, which could cause you to lose your session. – Marc B Nov 13 '14 at 15:54
  • Thanks for the comments. Yes, I always display all PHP warnings and errors when working. The headers are not being sent before the session. I have not tried to check the return value of the session_regenerate_id() yet, I'll go check it out. Thanks. – Gosre Nov 13 '14 at 16:12
  • are you calling `session_start()` at the very top of your page? – Gerald Schneider Nov 13 '14 at 16:16
  • @GeraldSchneider, yes I am. – Gosre Nov 13 '14 at 16:35

0 Answers0