php sessions doesn't continue previous sessions when set over specific pathes

Question

my objective: I set two cookies over two different pathes containing session Ids

These two pathes are not common so cookies are not shared /baharshop/admin/ /baharshop/public/ in requests from /baharshop/admin/ only one session is created but in requests from /baharshop/public/ sessions keep creating and can't get a hold to previous session and also if I write session_start in /baharshop/public/ and only run requests from /baharshop/admin/ again new sessions are created for /baharshop/public/ without even runnig any requests from /baharshop/public/

now my project directory design is like this

1. /baharshop/ -- root director
2. /baharshop/admin/
3. /baharshop/public/

upon loading any requests from /baharshop/admin/ I first include file config_admin.php to start one session only

config_admin.php

session_set_cookie_params((7 * (24*3600)), "/baharshop/admin/");
session_start();

then offcourse include the file in all /baharshop/admin/ applications

<?php require_once "../config/config_admin.php";?>
<?php
echo "<pre>";
print_r($_COOKIE);
echo "</pre>";

}
?>

and it works just fine

problem is upon only adding these lines in config_public.php

config_public.php 
session_set_cookie_params( ((6*31) * (24*3600)), "/baharshop/public/");
session_start();

then for every request from "/baharshop/public/" new sessions keep creating again and again

<?php require_once "../config/config_public.php";?>

<?php

function get_content(): void{
    echo "<pre>";
    print_r($_COOKIE);
    echo "</pre>";
}

Answer 1

The basics of a session in PHP:

session_name

• The name of the session (not to be confused with the session_id !!!). It normally is PHPSESSID, but you can change it to something like SOMENAME if you want.
• If you use sessions, all users of your site will have a cookie with this name, but all the cookies will have a different value, namely the...

session_id

• A random id generated by PHP, for example: abcde12345
• A _session file with the same name (sess_abcde12345) is created in de session storage folder on the server.
• As the PHP script ends, the session_id is forgotten, but the session file still exists.
• To know the name of the session file to use for a particular user, there is the...

session_cookie

• a cookie in the browser, where the session_id is stored (only the id, no other data!).
• the session_name is the NAME of the cookie.
• the session_id is the VALUE of the cookie.
• It is send to the server with every request and can be read by PHP so it can use the correct session file.

session_file

• The file stored on the server by PHP, containing the data.
• It can be accessed (after calling session_start()) by using $_SESSION[ somekey].
• If the browser is closed, the session_cookie is deleted and the connection between user and the session file on the server is forever lost, unless you change the lifetime of the cookie. But I won't recommend that. It's called a session so use it for the period the user has your site open. Important data should be stored in a database or different folder and file, as the session file can deleted.

Now to your question: why use TWO different sessions for admin and user? ONE would do, as the session data is basically an array and can contain anything, and the session is - if you don't change settings - valid for the entire domain.

If the user logs in set $_SESSION['user_id']=userID. Every subsequent call to the server to request a user page or user data you can check if(!empty($_SESSION['user_id'])). If this is true the user is logged in.

The same goes for the admin pages. If the admin logs in, set $_SESSION['admin_id']=adminID and check in subsequent admin pages. (Instead of adminID you can also use the userID, as long as you use different array keys to check for: user_id for user pages and admin_id for admin pages.)

This can all be done by the same session, even in different tabs in your browser.

You can even differentiate between users with no admin rights and users with admin rights when they login as normal user. Simply set something like $_SESSION['IsAlsoAdmin']=true. In that case, the user can go from user pages directly to admin pages, without having to login again (and vice versa).

All that said, if you really, really want to use two different sessions, you have to change the path of the session cookie by using session_set_cookie_params. There, in the path part of the command, you have to differentiate to make the session cookie only valid for the admin part of your domain. But read this question and answer about the pitfalls of that approach.