如何在PHP和ASP.net应用程序之间共享会话？

Question

My company took some old php application over. Due to our preference to ASP.net and to the lack of any documentation from the previous developer, we do not want to spend much resources on developing in PHP. For implementing new features, we will create an Asp.net application that has the same look to the user. We want to develop a kind of 'coexisting' web application. Therefore we must share sessions between an PHP and an Asp.net webapplication project, because there is a usermanagement involved with an existing MySQL database.

(eg link 'A' directs to the PHP website, and link 'B' directs to the asp.net application)

How can we share the session between and PHP and an asp.net application?

And does anyone have a hint for this 'coexisting' thing, that might be useful in development?

Edit : IIS 6 would be our targeted server, altough IIS 7.5 would also be an option

Answer 1

I want to tell you, how I ended up doing it.

Both applications access a MySQL database and access a "session" table, which consists of a Guid, the ID of the user, and a confirmationString (I guess I encoded the IDUser in it, somehow) and a date.

Sessions are only started by the PHP application (due to the fact, that the PHP application is still the main application). A new session will result in a new entry in the log table. Every link in the PHP application, that links to the ASP.Net application contains GET-Parameters, containing the Guid etc.

The ASP.net application checks for the GET-Parameters and sets the IDUser in the ASP.Net Session, if the GET-Parameters point to an existing session.

The links pointing back to the PHP application use the same technique.

(There are also other things to consider, like timeouts or logouts, but that can be handled as well)

All in all, I'd say that my approach is useful and none of the customers complained since the deployment (over 1 year ago)

Answer 2

This is an old question, but I didn't think any of the current answers were complete.

First, I think it is a bad idea to store session data in a database server like mysql or SQL Server. The DB is a precious resource, and there's really no reason to thrash it just for session data.

If you are going to store session in a database like that, there are "better" ways of doing it, like making sure that the session data is on it's own independent disk, etc... but honestly, I still feel like it's a mistake and will limit your scalability.

For storing session, you want to go with a simple key/value store, and in my opinion you can't beat memcached (though I've also had good luck with redis + nodejs).

memcached has clients available for pretty much every language on earth: http://code.google.com/p/memcached/wiki/Clients

So, basically all you need to do when using memcached is generate a pseudo-random token for the key, and do a memcached.set. Then store that key in a cookie called session-id or something.

The session-id cookie can be read from any server language, .net, php, python, whatever - and the session value retrieved with a simple memcached.get.

Check out the memcached docs: http://code.google.com/p/memcached/wiki/NewStart

This is a very simple and scalable way to do sessions, and will work with almost any language/server.

Answer 3

I don't think it's natively possible to share sessions between PHP and ASP.NET.

However, it might be possible by using a PHP page that reads the contents of the session, stores them in hidden fields and then call an ASP.NET page that would read these fields and load them into ASP.NET session.

Theoretically it's possible.

Answer 4

http://cz.php.net/manual/en/function.session-set-save-handler.php
http://support.microsoft.com/kb/317604

You can write PHP's sessions into MsSQL, and configure .NET to use MsSQL as backend for sessions.

Answer 5

Not a big deal.
Your asp app should do a three simple things:

• Recieve a sessionid cookie from the client
• look for the sess_<id> file in the PHP session save path
• implement a PHP serialize/unserialize functions to read/write session data.

Answer 6

A nicer way than just hacking into session storage mechanisms on both sides would be setting up OpenId provider and plugging OpenId consumers to both asp.net and php applications.

There's lot of existing code to do it. It would be both more elegant and error prone than the low level solutions. As a bonus you could use integrated OpenId login in the rest of your company applications and become a company hero.

See: Using OpenID for both .NET/Windows and PHP/Linux/Apache web sites

Answer 7

Oh dear, maybe one day you'll see the error of your ways, in the meantime.....

By default, PHP writes its session data as a serialized array into a file named according to the session. The session is identified usually by a cookie with name PHPSESSID.

So in PHP to manually read the session:

$imported_session=unserialize(file_get_contents(session_save_path() . '/' . $_COOKIE[session_name()]));

The format of the file is very straightforward and simple to parse.

However its quite easy to implement your own PHP session handler to write the files in any format/to any storage you like (have a look at auto-prepend for how to associate the revosed code with every page without having to rewrite each one). Or change the name the cookie used to store the session.

C.