Skip to content

Commit

Permalink
Update Authentication.php
Browse files Browse the repository at this point in the history 
I've added a SSL proxy check. If a SSL proxy is used, domain and path of cookie have to be set differently.
  • Loading branch information
@zajad
zajad committed Jun 1, 2013
1 parent e7a5a79 commit 9ac92c1
Showing 1 changed file with 9 additions and 1 deletion.
10 changes: 9 additions & 1 deletion helpers/Authentication.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,16 @@ class Authentication {
* start session and check login
*/
public function __construct() {

// check for SSL proxy and special cookie options
if(isset($_SERVER['HTTP_X_FORWARDED_SERVER'])) {
// set cookie details (http://php.net/manual/en/function.setcookie.php)
// expire, path, domain, secure, httponly
session_set_cookie_params((3600*24*30), '/'.$_SERVER['SERVER_NAME'].preg_replace('/\/[^\/]+$/','',$_SERVER['PHP_SELF']).'/', $_SERVER['HTTP_X_FORWARDED_SERVER'], "true", "true");

This comment has been minimized.

Sign in to view

Copy link
@arbk

arbk Sep 18, 2013

Contributor

Hello.

In this code, cookie is not set in my environment (reverse proxy is used).

I think that it is not necessarily SSL proxy even if "$_SERVER['HTTP_X_FORWARDED_SERVER']" is set.
(For example, reverse proxy and load balancer, and so on.)
Moreover, path and domain do not necessarily change.

Can the condition be changed?

I am doing as follows for now.

if(isset($_SERVER['HTTP_X_FORWARDED_SERVER'])
   &&isset($_SERVER['HTTP_X_FORWARDED_HOST'])
   &&($_SERVER['HTTP_X_FORWARDED_SERVER']===$_SERVER['HTTP_X_FORWARDED_HOST'])) {
    // set cookie details (http://php.net/manual/en/function.setcookie.php)
    // expire, path, domain, secure, httponly
    session_set_cookie_params(
        (3600*24*30), 
        '/'.$_SERVER['SERVER_NAME'].preg_replace('/\/[^\/]+$/','',$_SERVER['PHP_SELF']).'/', 
        $_SERVER['HTTP_X_FORWARDED_SERVER'], 
        (isset($_SERVER['HTTPS'])&&"off"!==$_SERVER['HTTPS'])?"true":"false", 
        "true");

Best regards.
} else {
// session cookie will be valid for one month
session_set_cookie_params((3600*24*30), "/");
}

session_name();
if(session_id()=="")
Expand Down Expand Up @@ -117,4 +125,4 @@ public function logout() {
$_SESSION['loggedin'] = false;
session_destroy();
}
}
}

0 comments on commit 9ac92c1

Please sign in to comment.