Doing some testing, and stumbled across the "CraftSessionId" cookie...
What's the difference between CraftSessionId and a normal PHP session? Is there any difference at all? What's the best way to refer to the current session?
1
1 Answer
They are one in the same.
Craft simply renames it to "CraftSessionId" rather than the default "PHPSESSIONID".
The only additional things we do to it is set the "httpOnly" flag so that JavaScript can't read it and change the place it is saved to by default (varies per server) to craft/storage/runtime/sessions.
You can see that in action in HttpSessionService, which extends Yii's CHttpSession, which is a convenient wrapper for PHP's session functionality.
answered Jul 24, 2014 at 21:46
-
Thanks Brad! Am I also correct in thinking that
session_startis automatically called by Craft every time a page is loaded? Commented Jul 24, 2014 at 21:51 -
It'll be called the very first time HttpSessionService\CHttpSession get loaded and initialized in a request.– Brad Bell ♦Commented Jul 24, 2014 at 21:53
-
"JavaScript can't read it" ... Very good to know, actually impacts what I'm working on! Sounds like I'll need to have JS ping a Controller (which will then access the session in PHP). Commented Jul 24, 2014 at 21:55
-
1Hah, it actually used to be open to JS (up until 2.0, I think), but you know... security and whatnot.– Brad Bell ♦Commented Jul 24, 2014 at 22:10
-
session_start()... Instead, you'll want to usecraft()->getSession()to trigger a new session (or revive an existing one). Once you've done that, you'll be able to get your session ID normally viasession_id().