-1

I am running the PHP:FPM container on Docker. I start a session, create a session ID, and then use print_r to display the session data.

<?php
  session_start();
  $_SESSION['id'] = session_id();
  print_r ($_SESSION);
?>

I get the following output which shows that the session ID is as84kcq75m8ev6a7srv8nutak5.

Array ( [id] => as84kcq75m8ev6a7srv8nutak5 )

And in the container, I can see the session file exists, owned by www-data, and is 37 bytes (contains data).

[jeremy.canfield@docker1 ~]$ sudo docker exec php-fpm ls -l /usr/local/sessions
-rw-------. 1 www-data www-data 37 Feb 19 03:03 sess_as84kcq75m8ev6a7srv8nutak5

And the session file contains ID as84kcq75m8ev6a7srv8nutak5.

[jeremy.canfield@docker1 ~]$ sudo docker exec php-fpm cat /usr/local/sessions/sess_as84kcq75m8ev6a7srv8nutak5
id|s:26:"as84kcq75m8ev6a7srv8nutak5";

Let's say I do this, using the file function to read the /usr/local/sessions/sess_as84kcq75m8ev6a7srv8nutak5 file.

<?php
  session_start();
  $_SESSION['id'] = session_id();
  echo "I am " . exec('whoami');
  $file = file("/usr/local/sessions/sess_$_SESSION[id]");
  print_r ($file);
?>

The first time I load this page, I can see that I am the www-data user, and thus have read access to the /usr/local/sessions/sess_as84kcq75m8ev6a7srv8nutak5 file, but the print_r ($file) command is returning an empty array, meaning the file function failed to load the content of /usr/local/sessions/sess_as84kcq75m8ev6a7srv8nutak5 into the $file array.

I am www-data
Array ( )

Then I reload my PHP page and the following is returned, showing that the file function successfully loaded the content of the /usr/local/sessions/sess_as84kcq75m8ev6a7srv8nutak5 file into the $file array.

I am www-data
Array ( [0] => id|s:26:"as84kcq75m8ev6a7srv8nutak5"; )

I am not sure how to get the $file array to contain the content of the /usr/local/sessions/sess_as84kcq75m8ev6a7srv8nutak5 file the first time the PHP page is loaded.

JeremyCanfield
  • 633
  • 11
  • 24

1 Answers1

2

Session is supposed to be read and write using merely the $_SESSION super global array and the session_start() function. There is no good reason to deal with the raw session file format (which probably is simply array of serialized strings that you can unserialize.)

If you want more control with your session data (e.g. access all the session data of your user, control how they are expired), you should write your own SessionHandler implementation and then set it as your session handler. If you know how to use composer, you can even find existing implementations of session handlers for mysql, mongodb or other backends.

Koala Yeung
  • 7,475
  • 3
  • 30
  • 50