Dayspring Technologies

The secure pages at one site we developed require one to login with a username and password — a successful login will create a session cookie that keeps a user logged in for one hour.

Now our client reported a problem with one of their computers accessing the secure section of the site.  A user could log in successfully, but their next page request would kick them out to the login page.

Brian checked the browser’s security settings and it was correctly set up to accept cookies.  However, after looking in the Temporary Internet Files folder, we could not find any trace of the cookie.

After spending some time researching possible solutions to “cookies not being set”, I compiled this list of fixes that other users seemed to have success with:

1. ini_set("session.use_only_cookies", 1);
2. increase cookie expiration to fix any time-sync issues
3. header(’P3P: CP=”NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM”‘);
4. session_set_cookie_params(86400,"/","domainname.com");
5. wrapping any header("Location: ....") redirects with “session_write_close()” and “exit()“

Starting at the top of this list, I tested each fix on the client’s computer using the remote access software LogMeIn.

When I got to #2, I started by increased the cookie expiration time to 1 year.  It worked!  I could now access the secure pages without getting kicked out to the login screen.  I kept decreasing the expiration time until I reproduced the original bug.  The minimum expiration time turned out to be 10,800 seconds (3 hours) which was the exact timezone difference.  Hmmm….

Brian suggested I check the computer’s clock, but it looked perfect.  It was set to exactly 3 hours ahead.

BUT the selected timezone was Pacific, not Eastern Time. So this computer was 3 hours ahead of the server, and this time difference was causing the immediate expiration of our 1-hour session cookie.

I changed the timezone to Eastern Time and increased the cookie expiration to 4 hours (just to be on the safe side).

Problem solved!

Tags: cookies, sessions, timeouts

This entry was posted by Jon Y. on Friday, June 19th, 2009 at 2:46 pm and is filed under Browsers, Technology. You can follow any responses to this entry through the RSS 2.0 feed.