将用户重定向到www.url-$ _SESSION问题

Question

The Issue

My domain is www.example.com . If a user logs in and then closes the tab, then later opens it and goes to www.example.com , the session continues absolutely fine, with the user logged in.

However, if they type example.com (without the www. ) then they appear logged out, and if I place print_r($_SESSION) nothing comes up. However, clicking any link on the page (redirecting the user to www.example.com/link ) restores their session.

Therefore I've realised that the user appears logged out when they type in example.com without the trailing www - something that a lot of users (like myself) do regularly.

The Question

The two ways I can see of fixing this are either:

• Find a way for the $_SESSION to be applicable to any url subdomain (or lack thereof)
• Redirect users who type in example.com to www.example.com

Are either of these are feasible and, if so, which is the best practice?

Answer 1

When the session cookie is set, it uses the current domain. But you can configure that this cookie should allow for wildcard domain "*.example.com" instead. That way the session would continue on either url. Be informed that wildcard domain cookies are a little bit unsafer, because they will be sent to ANY subdomain of "example.com" - even those subdomains that you created on some other server. This might not be an issue, but should be mentioned.

But the real fix should be to only have ONE designated domain to be used. Redirect the user to this one domain with a permanent redirect code. That also circumvents the duplicate content issue of search engines (which is not a penalty, but rather the question of "Which of the two URLs should be shown as a search result?").