1

I'm using sessions to send variables over forms to securely delete records on a backend. Everything works just fine:

  1. I create the list of records, along with delete buttons as forms.
  2. While creating the delete buttons I set a session including the token and the id of the item to delete.
  3. When I click the delete button (which submits the form) the action is called in the php file that handles the action. I read the token, compare it to the one sent in the form, retrieve from the session the id of the item to be deleted, delete the item.
  4. Redirect the user to the previous page.

However, after the redirect, this does not work unless I refresh the page before deleting. Even though the session is created again after the redirection (I already checked this works fine), when I submit a delete form again, the session does not persist to the file that handles the form.

Does anyone have any idea of what might be happening?

How I set the session:

$token = SessionManager::setTokenForForm('delete-' . $row->id, $values);

echo '<form method="post" action="' . FrontendConstants::$BASE_URL . FrontendConstants::$DELETE_RECORD_URL . '">';
echo '  <input type="hidden" name="token" value="' . $token . '"/>';
echo '    <input type="hidden" name="redirect_url" value="' . $fullRedirectUrl . '"/>';
echo '    <input type="hidden" name="id" value="' . $row->id . '"/>';
echo '    <input type="submit" class="btn btn-default" value="Delete"/>';
echo ' </form>';

The function setTokenForForm: 

public static function setTokenForForm($form, $values = null) {
        $token = uniqid();
        if (!isset($_SESSION)) {
            session_start();
        }

        $session = array();

        $session['token'] = $token;

        if ($values != null) {
            $session['values'] = $values;
        } else {
            $session['values'] = array();
        }

        $_SESSION[$form] = $session;

        return $token;
 }

On delete.php, which is the file being called by the form, after consulting the session and deleting the item, I redirect to the previous page:

header('Location: ' . $redirect_url);
José Carranza
  • 9
  • 2
  • 1
    Please provide some code snippet of your php session code so that we can help you!! – Mahesh Singh Chouhan Apr 03 '17 at 18:56
  • Done, I added the relevant code. Thanks! – José Carranza Apr 03 '17 at 19:04
  • Make sure you redirect to the same hostname. By default, session cookies doesn't pass between `example.com` and `www.example.com`. Also, `http` and `https` cookies are differ by default. – umka Apr 03 '17 at 19:27
  • I already checked and I'm redirecting to the same hostname. The odd thing is that the session is being set after the redirection. After the redirection the session is set again along with the delete forms, and when those forms are submitted the session is lost only if the pages comes from a redirection. If I refresh the page and submit the form again it works just fine. – José Carranza Apr 03 '17 at 19:33

0 Answers0