12
Craft's HttpSessionService is a thin wrapper for PHP's global $_SESSION variable.
You can use:
craft()->httpSession->add($key, $value)
and:
craft()->httpSession->get($key)
to save and retrieve values from it.
11
And for those needing this for Craft 3...
Set (previously called 'add'):
Craft::$app->getSession()->set($key, $value);
Get
Craft::$app->getSession()->get($key);
10
The problem was actually Chrome using iOS emulation when viewing the site, thus spoofing the UA string into something different than the usual Chrome UA string when logging into the admin area.
Solution (as suggested by @craftcms on Twitter) was to set:
'requireMatchingUserAgentForSession' => false
In
craft/config/general.php
For whatever environment ...
7
To store sessions in the DB in Craft 3, you can merge the following into your config/app.php file:
return [
'components' => [
'session' => [
'class' => yii\web\DbSession::class,
'as session' => craft\behaviors\SessionBehavior::class
],
],
];
Then you need to manually create a session table in your ...
5
This can be done with a plugin.
The plugin would create an 'activity' table that saves the current user's ID and a timestamp of their last known activity.
You can insert the first row by listening to the onLogin event and remove their row by listening to the onLogout.
All subsequent requests, you'd compare the last known activity timestamp to the ...
5
Save yourself the headache and don't store an entire Model in session. More to the point, don't store any complex objects in session.
It's much better practice to store just the information you need in session to create the model when it's needed (i.e. some unique ID). You won't run into issues like you're seeing and you won't be using unnecessary server ...
5
This may help:
Add the following to the general.php
'cacheMethod' => 'redis',
'overridePhpSessionLocation' => 'tcp://localhost:6379'
Add the following to the index.php
ini_set('session.save_handler', 'redis')
5
The problem is that the basepath changes each time you deploy (Capistrano uses versioned release directories). The basepath is used to generate a session key, which is invalidated each time a new deployment is made.
The answer is to add the appId parameter to config/general.php. The docs give a good explanation
The application ID, which is used for ...
4
If you place a PHP file in craft/translations named after a locale ID and returning an array, those values will be used instead.
craft/translations/en.php
<?php
return array(
'Logged in.' => 'Good to see you.',
);
Craft's own CP translation files can be found in craft/app/translations.
You can read more about it here: http://buildwithcraft.com/...
4
Unfortunately, the AJAX call to getAuthTimeout is hard coded to fire every 60 seconds. In other words, if you're looking for a config value, there isn't one – might be worth a feature request?
For a quickfix/hack, you can create a custom plugin and add the following to its init method:
craft()->templates->includeJs('(function () {
Craft....
answered Mar 10 '16 at 15:33
Mats Mikkel Rummelhoff
18.8k3 gold badges26 silver badges59 bronze badges
4
We managed to circumvent the issue by using the sql session storage SimpleSAML PHP also provides. Not a real solution but a viable workaround.
3
This was related to the place that the sessions were being stored with my hosting company (Vidahost). Using the Utils section in Craft2, we managed to track it down to being stored with memcache. This meant that true and auto wouldn't work, and we had to set the override to false. False is meant to be the default anyway, but it seems to be working now that ...
3
Old post, I know, but we've recently published a plugin to achieve this for a similar problem we were facing.
SessionExposer plugin can help you achieve this. To get the Session ID in the template you use
{{ craft.sessionExposer.sessionId }}
3
What you want is this:
// Returns how many seconds are left in the current user session.
// (int) The seconds left in the session, or -1 if their session
// will expire when their HTTP session ends.
craft()->userSession->getAuthTimeout()
You can then combine this with a Javascript setTimeout when the page loads so you can trigger whatever messages ...
3
Try this:
$cookie = new HttpCookie('myCookieName', $data, [ 'expire' => time() + 3600 ]);
craft()->request->getCookies()->add( $cookie->name, $cookie );
Your code for reading the cookie is fine.
Also – since you use the term "session value" and tagged your question w/ "security" – I'd like to point out that cookies and session variables are ...
answered Mar 25 '15 at 23:42
Mats Mikkel Rummelhoff
18.8k3 gold badges26 silver badges59 bronze badges
3
As of Craft 2.3, overridePhpSessionLocation is set to false by default. Meaning that wherever Apache (or whatever web server you're using) and PHP is configured to save the PHP session files, that's where they will go.
If you set overridePhpSessionLocation to true, then the session files will be saved in craft/storage/runtime/session. Just be aware there ...
3
The Matt's answer was pretty complete and worked almost, but for the benefit of others, there is the changes required files to make it works:
in integration.php
find
define('SET_SESSION_NAME','');
change for
define('SET_SESSION_NAME','CraftSessionId');
and make your getUserID functions look like
function getUserID() {
$userId = 0; // ...
3
They are one in the same.
Craft simply renames it to "CraftSessionId" rather than the default "PHPSESSIONID".
The only additional things we do to it is set the "httpOnly" flag so that JavaScript can't read it and change the place it is saved to by default (varies per server) to craft/storage/runtime/sessions.
You can see that in action in ...
3
Im on Craft v3.4.25, and I've added the following event handler in my module to handle this. There are two scenarios here: either you want the new login to invalidate any existing session, or you want to block the new login if an active session exists.
If you want the new session to succeed, and log out any other sessions for that same user, you can do this:
...
3
The issue here is that extends isn't the same thing, neither conceptually or technically, as an include. When you extend a template with a layout template, the template is "decorated" by the layout. So, what's happening is that the code in the layout is parsed after all of the code in the template.
Check out this article on straightupcraft explains the ...
3
Thanks for the troubleshooting help. It appears as though the issue was the cache and how Craft handles sessions.
For those who use a cache/CDN and are having issues with control panel session timeout:
Even after ignoring /admin on our cache, the cached pages on the public-facing portion of the site were conflicting somehow with how Craft was handling the ...
3
I'm not sure there is going to be an easy way to do this in Craft 2, unfortunately.
In the upcoming Craft 3, we refactored the session logic so that a session will only get started on requests that actually need session, which is basically what you're looking for.
3
Thanks to Brad's help, we discovered that the server was misconfigured with an incorrect value for session.cookie_domain. Fixing that resolved the issue in this case.
3
Docs
runtime/ – Pretty much everything in here is there for caching and logging purposes. Nothing that Craft couldn’t live without, if the folder happened to get deleted.
It is safe to delete it
3
@boboldehampsink to the rescue: https://github.com/craftcms/cms/issues/3428
Update:
This article covers things really well.
https://nystudio107.com/blog/the-case-of-the-missing-php-session
php ini config
[Session]
; http://www.php.net/manual/en/session.configuration.php#ini.session.save-handler
session.save_handler = redis
session.save_path = "tcp://127....
3
Yes! The setting is called userSessionDuration, and you can set it in your general.php config file, on a per-environment basis.
Here's an explanation of the values that you can use for the setting—for posterity: integers (in seconds), a PHP duration expression, an initialized DateInterval object, or 0 for "indefinite."
The link above points to the Craft 3 ...
3
You could for example just edit the translation file with the specific user registered flash message.
You can read more about the static translation in the docs.
2
Not particularly.
UserSessionService has setNotice() and setErrors(), which are just wrappers for Yii's setFlash() where we pass in an 'error' or 'notice' for the key.
Yii will take than and prepend the FLASH_KEY_PREFIX const which we set to Craft.UserSessionService.flash..
So an error's key will end up being Craft.UserSessionService.flash.error and a ...
2
So, the Comet Chat is not able to read the userid, even if I made a Craft plugin who writes UserID in $_SESSION['userid'].
To access Craft's session variables outside Craft, you need to pull the session ID from the CraftSessionId cookie, and then use that to revive the session:
$sessId = $_COOKIE[ 'CraftSessionId' ] ?: false;
if ( $sessId ) {
...
answered Apr 5 '15 at 20:43
Mats Mikkel Rummelhoff
18.8k3 gold badges26 silver badges59 bronze badges
2
Try all of the above suggestions first, then...
If you've added the configuration of 'defaultCookieDomain' to /craft/config/general.php as I did, you may see this error. I'm using MAMP which has no value set for session.cookie_domain in php.ini. I'm assuming that the conflict between my config setting in Craft and the setting in php.ini was the cause of ...
Only top voted, non community-wiki answers of a minimum length are eligible