用户不接受Cookies-登录PHP

Question

In my login code on my website, if the password & username are correct, I set a cookie to keep the user logged in. I just heard from a user that he doesn't accept cookies automatically through his browser, and that that prevents him from logging in. That rhe cookie is not set.

Is there an easy way to counter that? Tell me if you need the code I use.

Answer 1

It is possible to get this to work but often a real pain if you're using complex javascript/ajax.

In short, instead of storing the session id in a cookie, you embed it at the end of every link.

so

http://example.com/somepage.php

becomes

http://example.com/somepage.php?SessionId=ABC123

Unfortunately, while PHP can do this for you in some cases, it doesn't help with links you build yourself in javascript - and it only takes clicking a single link without the id to effectively log the user out

See this page for more information

As mentioned by Quentin in the comments, if you're not using a cookie to identify the browser which created the session, it's possible that sharing a link would share the session. This could be mitigated but not prevented by checking IP address/user agent but this would likely fail in large corporate environments with NAT and standard browsers