Keep PHP Sessions alive between two requests using C# HttpClient

Question

I want know if it's possible to keep PHP sessions alive between two requests...

I do the requests using Flurl plugin:

    public const string ApiUrl = "http://localhost/z/api.php";

    public static string MethodName()
    {
        using (FlurlClient client = new FlurlClient())
        {
            string res = client.HttpGet(string.Format("{0}?action={1}", ApiUrl, "captcha"), true);

            //Some actions...

            return client.HttpPost(ApiUrl, new { action = "resolve-captcha", input = r }, false);
        }
    }

    public static string HttpPost(this FlurlClient client, string url, object data, bool keepalive = false)
    {
        return client.Request(url).PostUrlEncodedAsync(data).ReceiveString().GetAwaiter().GetResult();
    }

    public static string HttpGet(this FlurlClient client, string url, bool keepalive = false)
    {
        return client.Request(url).GetStringAsync().GetAwaiter().GetResult();
    }

And in the PHP part (API):

//if isset $_GET then switch action key...
case "captcha":
    if (session_status() == PHP_SESSION_NONE)
        session_start();

    $_SESSION['phrase'] = "hello";
    break;

//if isset $_POST then switch action key...
case "resolve-captcha":
    $secret = @$_SESSION["phrase"];

    if(session_status() == PHP_SESSION_NONE)
        die("No session!");
    else
        $coreData["secret"] = $secret;

    $input = @$_POST["input"];
    $coreData["valid"] = $input === $secret;
    break;

But for some reason, every time I do the next step (Post) the api returns that there isn't any session running.

As you can see here:

I have been reading and all the answers says the same, that I have to use cookies, cookies for what? To store the secret that the server should keep? I need to know how can I do two requests with the same session or at least if this is possible, because I don't want to use MySQL (with an ID system, ie), I prefer to keep it easy.

When you authenticate with the web application a session is created. That session is maintained across requests by the client including those cookies in subsequent requests (and yes the cookie will likely have a session identifier in it). Maybe look at a cURL cookie jar example? — ficuscr, May 08 '18 at 21:52
Oh, it is the reverse, even better. Here is an example: https://stackoverflow.com/questions/13020404/keeping-session-alive-with-curl-and-php Ugh, had to reread the question a few times... how does the API handle authentication? — ficuscr, May 08 '18 at 21:55
Thanks @ficuscr well I readed the thing you said with IDs in the cookies and it's presence in subsequent requests, but I didn't understand what are my possiblities which this ID, is like people are answering that with this IDs you can get the data from the last SESSION. — z3nth10n, May 08 '18 at 22:00
Try changing it to: using (FlurlClient client = new FlurlClient().EnableCookies()) — David Moore, May 08 '18 at 22:23
@DavidMoore this only enable cookies, but I don't really know how to use them to keep sessions alive or to make an identification system — z3nth10n, May 08 '18 at 22:27
@z3nth10n When you create the session in PHP, it will send a cookie back to the client for the session. The client then needs to send that same cookie back with the next request, and PHP will automatically recognize and re-use the session. Now if you were using the normal HttpClient, you would create a CookieContainer and re-use the client, and it would work. Because you're using Flurl, I'm unfamiliar with that, so check their docs. You simply have to tell it to remember cookies from the server and send them with subsequent requests. — David Moore, May 08 '18 at 22:30
Now I feel so stupid because I readed it somewhere like 3 hours ago... https://i.gyazo.com/98e9c442995fe75720ccfa171bef63b0.png — z3nth10n, May 08 '18 at 22:34
I solved it by passing my own id to the session via POST: https://i.gyazo.com/1abc7bcb13c84e958d7031d416e6dc86.png — z3nth10n, May 08 '18 at 22:54

ficuscr · Answer 1 · 2018-05-08T22:21:54.873

HTTP being a stateless protocol the only way to "keep sessions alive" is to provide a session identifier in the query string or though inclusion of cookies that were returned as part of the first, authenticating, request.

That is the typical paradigm for a user accessing a web application from a web browser, or even in cURL.

Most API's, going back to the days of SOAP through the present, are set up differently. They have you authenticate with every request. Just more practical with how they are used... from serverside code or with Xhr client side.

For example authenticating using JWT tokens is a common approach these days. You can expose the URI with the signed token to the end user, and short of potentially replay attacks, not have to worry.

I think instead of me trying to explain you should read this excellent article: http://shiflett.org/articles/the-truth-about-sessions There is a lot going on under the hood in PHP when it comes to sessions and cookies - worth checking out the section in the manual that pertains to INI settings related to those two.

OK, so the API is the PHP code right...?

session_start() creates a session or resumes the current one based on a session identifier passed via a GET or POST request, or passed via a cookie.

A good first step might be making the request to the API via your web browser, then looking in the response, do you see cookies being sent by the server?

On subsequent requests to the API, do you see those cookies being used - and we assume not asking you to re-authenticate? That's the gist of it. Again, depending on the nature of the API cookie based sessions might not be the best approach.

So, looks like support for cookies was added to that HTTP wrapper you use...https://github.com/tmenier/Flurl/issues/14

Possibly a more native approach? Struggling trying to get cookie out of response with HttpClient in .net 4.5

So, there's no way to achieve it if this isn't done with identifiers, and there's any alternative to SQL, because, I still don't understand how an identifier inside a cookie works, if you provide an example it will be great. And yep, I'm learning how to use JWT, also, I have posted a question with JOSE-JWT implementation for C#, also, you can see project title. Thanks!! — z3nth10n, May 08 '18 at 22:04
I take a lot of this for granted having moved from VB to web development many years ago, there is something of a paradigm shift. Strongly suggest getting in habit of inspecting requests and responses between client and server. Wireshark or at least 'browser tools'. I'll try and provide a better example now in my answer. — ficuscr, May 08 '18 at 22:07

Keep PHP Sessions alive between two requests using C# HttpClient

1 Answers1