如何使用瘦会话中间件在瘦休息框架中登录和退出用户？

Question

I am using Slim framework to build a REST API and this is a rough application that I am using for development purposes. I want to log user in and out , and I set the session variable to the user id. The user is able to login perfectly fine in rest API but the remote device doesnt recognize the session (which means my $SESSION['id'] is empty) where as I clearly started this session in my host rest service. Here is my code:

require 'lib/Slim/Slim.php';
use lib\Slim\Middleware\SessionCookie;

\Slim\Slim::registerAutoloader();

$app = new \Slim\Slim(
    array(
'cookies.encrypt' => true,
    'cookies.secret_key' => 'my_secret_key',
    'cookies.cipher' => MCRYPT_RIJNDAEL_256,
    'cookies.cipher_mode' => MCRYPT_MODE_CBC
        )
);

$app->add(new \Slim\Middleware\SessionCookie(array(
    'expires' => '20 minutes',
    'path' => '/',
    'domain' => '',
    'secure' => false,
    'httponly' => false,
    'name' => 'slim_session',
    'secret' => '',
    'cipher' => MCRYPT_RIJNDAEL_256,
    'cipher_mode' => MCRYPT_MODE_CBC
)));

$app->get("/login/:string", function($string) use ($app)
        {
            $input = json_decode($string);
            try 
            {
                if ($input->username && $input->password) 
                    {
                        $user = Model::factory('Users')->where("username",$input->username)->where("password",md5($input->password))->find_one();
                        //$app->setCookie('user_id',$user->id);
                            session_cache_limiter(false);
                            session_start();
                       $_SESSION['id'] =  $user->id;

                        $status = 'success';
                        $message = 'Logged in successfully.';
                    } 
                else
                        {
                            $status = false;
                            $message = 'Could not log you in. Please try again.';
                        }

            }
            catch (Exception $e) 
                    {
                        $status = 'danger';
                        $message = $e->getMessage();
                    }
            $response = array(
                'status' => $status,
                'message' => $message
            );
            $app->response()->header("Content-Type", "application/json");
            echo json_encode($response);

        });



        $app->get("/logout",function() use ($app)
        {


            try {
                        unset($_SESSION['id']);
                        session_destroy();
                        session_start();

                        //$app->getCookie('user_id');

                        $status = 'success';
                        $message = 'You have been logged out successfully';
                    } 

            catch (Exception $e) 
                    {
                        $status = 'danger';
                        $message = $e->getMessage();
                    }
            $response = array(
                'status' => $status,
                'message' => $message
            );

            $app->response()->header("Content-Type", "application/json");
            echo json_encode($response);

        });

It is returning 'Logged in successfully' but isn't actually logging me in so in my application when I check isset($_SESSION['id']) , there is nothing in the variable. Does anyone know whats going on? I am really confused because according to the slim documentation , it says :

The session cookie middleware will work seamlessly with the $_SESSION superglobal so you can easily migrate to this session storage middleware with zero changes to your application code.

If you use the session cookie middleware, you DO NOT need to start a native PHP session. The $_SESSION superglobal will still be available, and it will be persisted into an HTTP cookie via the middleware layer rather than with PHP's native session management.

Answer 1

The issue would seem to be that you are not starting your session soon enough not anything with session middleware I would place session_start() at the top of the index

require 'lib/Slim/Slim.php';
use lib\Slim\Middleware\SessionCookie;
session_start();

Now it is started every time your application routes. So in login and logout remove your session_start() calls. Now in logout route redirect to your landing page or somewhere like:

$app->redirect('/yourawesomepage');

that recalls session_start() so you can remove that from here your logout route.