delight-im / delight-im/PHP-Auth

How to attach to already started session?

Open
#285 3 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
PHP
Stars
1.2k
Forks
237
PR merge metrics
No merged PRs in 30d

Description

I build application where session is started by another function. Example:

`new \DB\SQL\Session($this->db, 'sessions', false, NULL, 'CSRF');`

This function create new session and add session data (CSRF token) to DB. Let's say it has ID: 1.

Now, I instantiate PHP-Auth:

```
$authdb = new \PDO('DB_CONN', 'DB_USERNAME','DB_PASSWORD');
$this->auth = new \Delight\Auth\Auth($authdb);
```

This action for some reason creates entirely different 2nd session with ID: 2 but not destroying session ID: 1. This behavior leads to very weird issue where data added to the session, but not seen.

However, this behavior not replicated when web browser "private" mode is used. In private mode, session ID: 1 is regenerated and updated correctly without spawning that ghostly session ID: 2.

Am I missing something with my logic? Why correct results are only in private browser mode?

Contributor guide

No contributing guide indexed for this repository

Research direction

No source file or test is named. Start by reproducing the two session IDs with the shown DB\SQL\Session and Delight\Auth\Auth setup, then trace how each component initializes or reuses the session; done means explaining the differing private-browser behavior and documenting or fixing the supported way to attach Auth to the existing session.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.