Hi!

I have interesting problem which I can't figure out for a long time.

Our website uses its own session handling module. It provides a unique
ID to a user i.e. SID. Copy of a SID is stored in the database.

Each link must have this SID as one of the parameters as well as each
form should have it too. Otherwise, the website will think that a user
is not logged in and it will keep generating a new SID.

Also, I just noticed that the website stores cookies with SID,
however, the website works perfectly without cookies. I tested in on
highest security settings in IE and I blocked all cookies.

The problem is that sometimes a user is getting logged out.

We investigated the issue and found out that when it happens PHP
does't get any input at all.

No $_POST, no $_COOKIE, no php://input ... Nothing!

However, the log files clearly shows that URL contains SID.

This issue was not a big deal until recenly - when we started to use
AJAX for some forms - we started to receive a lot of complains. It
seems that AJAX requests increased the rate of getting this issue. It
is very anoying for a user, when he/she losts all the data in the
middle of entering it (we started to use AJAX in some forms).

We have like 20-40 users daily using the website. AJAX forms might
generate 1-3 requests per 1-2 secons - it is maximum. So Apache might
will get 100 requests in one second - that's the maximum.

Our webserver uses SSL. We use mod_rewrite to redirect all requests to
HTTPS://. Can it be the problem with mod_rewrite ?

I'm already desperate with this issue. :(

I will really appreciate any help on this.

Check out the new CakePHP Questions site http://cakeqs.org and help others with 
their CakePHP related questions.

You received this message because you are subscribed to the Google Groups 
"CakePHP" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected] For more options, visit this group at 
http://groups.google.com/group/cake-php?hl=en

To unsubscribe, reply using "remove me" as the subject.

Reply via email to