After not finding a solution the entire day, I give it a try here on SO:
Scenario: A client can login and access video files. I provide the video files using PHP pseudo streaming (byte range requests). The video files are within a protected folder.
Setup:
loading.php provides the html5 video embed code:
<video ...> <source src="videoprovider.php?secure=CODE" type="video/webm"> </video>
videoprovider.php gets the code finds the right video and returns the video in byte ranges
Both PHP files check that the client is loggedin. For this purpose I am using modx in the beginning of each file with:
require_once DOCUMENT_ROOT.'modx/includes/config.inc.php';
startCMSSession(); // does session_start()
Then I can access the $_SESSION data that has been set at the time of login.
Everything works great on desktop but not for Android devices. The Android devices only show the video loading indicator and are stuck.
I printed the $_SESSION and found out that as soon as Android tries to play the video file (several range byte requests), the first request states the $_SESSION is there, the second request states there is no $_SESSION anymore.
I could not track down the error further. What is Android's problem? Why can it read the session and then not anymore.
Some Notes:
I have all files correctly linked, no 404 that could kill the session (at least not in the web developer console, don't see what Android is doing).
Calling startCMSSession(); several times, for each video range request, should not alter the session.
It works in all desktop browsers.
Update:
- I tried to use cookies but figured out that even cookies are not passed, so it seems not to be a modx-related issue but a complete Android issue. I updated the question title accordingly from "Android loses $_SESSION that is created by MODx Evo?" to "PHP: Android loses Session and Cookie information when using embedded video player"
- This is probably the same problem: Android 2.3 doesn't pass cookie information for html5 audio tag Get request Quoting:
The problem is, that the browser doesn't send the request for the audio-tag by itself but instead delegates this to stagefright. Sadly Stagefright (on Android 2.3) doesn't send any cookies at all...
So how to solve this? (My testing device is Android 4.)
