php setcookie failing

[mtfd]

I have a login system for our intranet that uses cookies to keep track of logged in users. I wrote it about a month ago and haven't touched it since. On Friday, it was working fine (cookies are set for one hour so I logged in multiple times on Friday). Today when I logged in, it failed to actually set the cookie on my dev machine. I tried it on our production machine and it is failing as well. I've tried to login from machines I don't normally use and get the same results.

The production machine is Windows server 2008. My dev machine is Windows 7. Both are running xampp 1.7.3. I've checked git on both machines to make sure that no one has modified the code over the weekend and everything looks fine.

I'm completely at a loss. Does anyone have any ideas as to what could be causing this?

[BigWetDog]

Well, it's certainly possible that a MS update may have changed something, so check your event logs to see what may have changed along those lines. Can you post your session cookie code? Also, on what browser(s) are you seeing this behaviour?

[mtfd]

Windows update is showing the last update as Aug 3rd. That's what I thought initially, an update breaking permissions to the temp folder but I don't think that's the case.

The login script hits the correct if branches (if post user & pass) and then uses the following:

Code: Select all

      $session_id = md5($user . microtime());
         $expiry = date('Y-m-d H:i:s', time() + 3600);
         $sql = "insert into sessions (id, user, expiry, session) values (null, '$user', '$expiry', '$session_id')";
         $query = $mysql->query($sql);
         setcookie('[company name]_login', $session_id, time() * 3600);
         #echo "Welcome, $user.<br/>";
         $logged_in = true;

This is in a try/catch block that isn't finding any exceptions. The SQL generated works fine as well (eg, no variables passed are empty/null).

The way the login page works is that it is included in all secured scripts (at the top). When $logged_in === true, the rest of the secured script can load, otherwise it outputs the login form and dies. When you login, it works fine except for setting the actual cookie - so the initial page load works as expected, but once you navigate around in the intranet, you are asked to login each time.

I'm using cookie editor in Firefox to confirm that the cookie is not being set.

As any web dev, I'm using all the browsers I can - Chrome, FF, IE, Opera, Safari.. even Lynx under cygwin. Nothing is working. I've restarted apache on both production and dev machines with the same results.

Absolutely maddening.

EDIT: Also, I've checked the insertions in to the table via phpmyadmin - that's working as expected as well.

[BigWetDog]

One thought, check the system date/time on your servers and clients. Based on you diagnostics, it certainly seems that the server isn't actually appending the cookie to the headers. You might try Wireshark or the like to confirm the http payload.

Another thought, check out your script to make sure there is no space before the <?PHP tag:

the setcookie function doesn't work if you send anything to the output buffer before it is used.
Even a white-space before the <?php tag will cause the function to fail.

[mtfd]

There are definitely no whitespaces or early output - I have it set to display all errors and warnings, strict, etc. I actually tested this before as well by var_dumping some session info and I got the header warning.

The date setup appears to be correct as well.

EDIT: I also used fiddler2 to confirm that there are no cookies being set.

/stumped.

[BigWetDog]

Throwing out another idea:
Maybe parse the script locally to see what it outputs to console, just to verify what's being produced. Just trying to isolate it back as far as possible.

[mtfd]

Are you saying use the CLI?
That won't really work as if there is no POST or GET directives, it just outputs the login form (HTML). I don't think the CLI handles cookies anyway.

[BigWetDog]

no, it won't handle them perse, but you should still see the http headers so you could try a simple test script that uses setcookie to check output.
But backing up, it doesn't make sense that this should be happening when browsing both servers, so it certainly seems unlikely that it's your code, unless you're not certain there was not a change to both.
This is just another shot in the dark, but is it possible that your LAN policy changed such that your internal network is now striping cookies?

[mtfd]

There was no changes to LAN (not even a router update). However, phpmyadmin is setting cookies, so I slapped a test script together and that appears to be setting cookies as well. However, this didn't start working until I rebooted my machine (eg, I ran the test script before and it didn't work, rebooted, reran without modification and presto, it suddenly works).

It seems that when my login script runs, the cookie that I manually set in the test script gets deleted. It might have something to do with the date/time as the only reason I can think of would be time() + 3600 isn't working correctly for the expiry.

I'll update when I figure out this voodoo but it looks like it's probably my script that is the problem.

[mtfd]

Got it working.

Instead of using a specific timestamp, eg:

Code: Select all

setcookie('name', 'session_data', (time()+3600));

I set the expiration to 0 which sets the expiration for browser close.

It now works as expected. Any ideas on what would cause this? The system time is accurate on here (updated before changing the expiration just to be sure). I'm happy it works but I still don't understand why I can't specify the time and, more importantly, why it would suddenly stop working after having been able to specify for so many weeks.

Very aggravating.