CodeIgniter 2.2.0 HMAC mismatch error

Question

UPDATE: Even after downloading the "fixed" 2.2.0, update log files are still filling up with:

Session: HMAC mismatch. The session cookie data did not match what was expected.

After upgrading from CodeIgniter 2.1.3 to 2.2.0 I am getting the error:

Session: HMAC mismatch. The session cookie data did not match what was expected.

The Mcrypt extension is enabled. If I set $config['sess_encrypt_cookie'] = FALSE; (not an option for production) there is no error. Any help greatly appreciated.

I'm having the exact same error. The only difference is that I upgraded from 2.1.4 to 2.2.0 — Josh, Jun 09 '14 at 14:17

score 3 · Answer 1 · answered Jun 09 '14 at 14:57

3

Re-download the CI 2.2 archive, it was re-tagged and replaced.

answered Jun 09 '14 at 14:57

Narf

14,600
3
37
66

don't download it from the official website, download it from github release – Josh Jun 09 '14 at 15:04
... I was the one to give you the github link. You just don't know how to clear your browser's download cache. – Narf Jun 09 '14 at 15:05

score 3 · Accepted Answer · answered Aug 12 '14 at 09:10

3

CI_Input->_sanitize_globals() function sometimes break encrypted session to fix this problem, I changed /system/core/Input.php (version 2.2, line 636)

$_COOKIE[$this->_clean_input_keys($key)] = $this->_clean_input_data($val);

to

if(!(config_item('sess_encrypt_cookie') === TRUE) || $key!=config_item('sess_cookie_name'))
    $_COOKIE[$this->_clean_input_keys($key)] = $this->_clean_input_data($val);

answered Aug 12 '14 at 09:10

Sanggoo

46
1

Thank you for confirming this was a framework issue. https://github.com/EllisLab/CodeIgniter/issues/3094#issuecomment-51899465 – suncoastkid Aug 12 '14 at 16:20

score 1 · Answer 3 · answered Jun 09 '14 at 14:45

in system/libraries/Sessions.php function _set_cookie function change:

if ($this->sess_encrypt_cookie == TRUE)
{
    $cookie_data = $this->CI->encrypt->encode($cookie_data);
}
else
{
    // if encryption is not used, we provide an md5 hash to prevent userside tampering
    $cookie_data .= hash_hmac('sha1', $cookie_data, $this->encryption_key);
}

to:

if ($this->sess_encrypt_cookie == TRUE)
{
    $cookie_data = $this->CI->encrypt->encode($cookie_data);
}

$cookie_data .= hash_hmac('sha1', $cookie_data, $this->encryption_key);

to see if it works.

see: https://github.com/EllisLab/CodeIgniter/issues/3086

score 0 · Answer 4 · answered Nov 09 '17 at 10:58

0

Beyond the above correction, I needed to change the following line:

if ($key === $sess_cookie_name && config_item('sess_encrypt_cookie'))

To:

if ($key === config_item('cookie_prefix') . $sess_cookie_name
    && config_item('sess_encrypt_cookie'))

Hope it helps, Regards.

answered Nov 09 '17 at 10:58

Éderson Fernandes

15
1
4

Please update your answer explain why your code is working. – Tom M Nov 09 '17 at 11:02
The patch provided does not respect the cookie prefix. – Éderson Fernandes Nov 09 '17 at 11:06

CodeIgniter 2.2.0 HMAC mismatch error

4 Answers4