nginx / php / php-fpm | Problem with storing cookies

Question

Greetings.

I am right now in the middle of reinstalling my whole dedicated server. I went with

-Ubuntu Server 10.10

-PHP 5.3.3.1

-php-fpm

-nginx

Now, almost everything seems to work, though there remains one problem with the sessions. No matter what I do, the sessions doesn't seem to store themselves properly (and they did on the previous setup).

The base application is phpBB board. When I login, it's okay - though it appends additional SID parameter to all of the URLs.

forum/index.php?sid=f506ccd42065322f61cb56fc6df6557a

You can navigate around the forums without problem, though if you delete the SID parameter, you get logged out. I thought, that perhaps the sessions aren't stored in cookies, but in URLs, but php configuration seems fine.

The same occurs with phpMyAdmin - I also get logged out, when I delete the token parameter.

In the meantime, it seems the cookies are getting created anyway, it's like they aren't used, or are getting deleted immediately.

I am getting more and more frustrated with that, maybe someone has an idea on how to troubleshoot that? I will post any configuration files necessary.

I thought maybe it's the problem with suhosin (it wasn't installed on the previous setup), but I have no clue. The PHP config is out-of-the box atm, I only modified nginx config.

Solution 1

May be some usefull information can be found in PHP-fpm error log? Set parameters in php.ini

error_reporting = E_ALL & ~E_DEPRECATED
log_errors = On
error_log = ;

some file php can write in or "syslog"

Also try to look in nginx error log.

Does PHP-fpm process-owner has write permissions to sessions dir? See session.save_path on php.ini for session dir

Solution 2

The various session cookie parameters are all documented here.

In particular, check the "session.use_cookies", "session.use_only_cookies", and "session.trans_sid" settings. If PHP can't succesfully create a cookie, it'll fall back to the trans_sid method (which is what you're seeeing: the session ID being passed around as a query/form variable).

You can trivially check if any cookie-related headers are going out by using Firebug and HTTPFox in Firefox. Both let you view the incoming/outgoing headers for requests.

Solution 3

See if your session_path is correct and has the right permissions. That fixed my problem.