I have a PHP website www.example.com which has a button opening a new window with JS. It then loads a unique url to www.thirdpartywebsite.com via AJAX and sets the window's url:
var newWindow = window.open("", "_blank", "scrollbars=yes,resizable=yes");
ajax("www.example.com/get-url",
{
data: someData,
success: function(response)
{
newWindow.location = response.url;
// something like www.thirdpartywebsite.com/catalog/12345xyz
}
});
Backend PHP code for www.example.com/get-url simply makes a curl request to www.thirdpartywebsite.com for the unique url and then returns it.
The returned third party site url is a page showing a catalog of items. Each item has a button redirecting the user back to my site with the item data in POST. The url for that is www.example.com/get-data with the following PHP code:
$itemData = $_POST["data"];
echo '<div id="content-json" style="display:none;">' . json_encode($itemData) . '</div>';
echo '<script>';
echo 'var json = document.getElementById("content-json").innerHTML;';
echo 'var data = JSON.parse(json);';
echo 'window.opener.returnCallback(data);';
echo 'window.close();';
echo "</script>';
The returnCallback function is on the same page (main window) as the button opening the new window:
function returnCallback(data)
{
// Set page's content with data
// ...
}
So basically we open a new window to other site, user does action, the new window redirects back to my site with POST data, gives the data to the main window as JS object and then closes the new window.
Now the problem is that the PHP session id gets regenerated when the new window is redirected back to my site. I have confirmed this with typing document.cookie into the main window's console.
Before clicking the button to open the new window and before clicking the button on the new window to redirect back to my site:
PHPSESSID=random12345
After redirecting back to my site and the new window closes:
PHPSESSID=random67890
What is even more interesting is that this doesn't happen every time and not with every user. It sometimes happens on one day on one browser with one user and then some other day/time it doesn't.
The only thing I can come up is if the domain changes between www.example.com and example.com but it's always https://www.example.com.
Anyone know any reason why this would happen?
