Comments on: PHP Shared Session Encoding Solution

By: akimo

akimo — Thu, 27 Sep 2012 16:44:36 +0000

Thanks a lot for this post. We’ve got the same issue and no clue that this problem is caused by the suhosin module.

By: Mikita Hrybaleu

Mikita Hrybaleu — Fri, 24 Aug 2012 15:53:03 +0000

Thanks! We spent a half of day to find difference in our php configuration.

By: gabriel solomon

gabriel solomon — Wed, 25 Jul 2012 09:39:38 +0000

thanks for sharing this!

I wasted a day trying to get sessions saved in the same table from 2 different subdomains to work

By: Aqeel

Aqeel — Wed, 16 May 2012 13:55:15 +0000

I have a forum site and a wordpress site running on same domain like http://forum.com and http://forum.com/wordpress. I used forum as the master and wordpress as slave. Till today we were on a shared host with no suhosin and it all worked. But after we did a server migration its not working. Do you know how can I get is synced again?
Thank you

By: rommel

rommel — Wed, 04 Apr 2012 17:22:57 +0000

Hi Aminho- Unfortunately, as the documentation reads, the default method they use is “a PHP internal format” meaning there’s no function in the language that generates the same serialization.

By: aminho

aminho — Wed, 04 Apr 2012 17:11:35 +0000

Thanks for sharing this article.
In a completely different scope, I was wondering how to get a|s:1:”b”; instead of a:1:{s:1:”a”;s:1:”b”;} when trying to encode an array (“a” => “b”). It appears that this serialization is done when encoding/decoding session data, but php documentation is not clear on that.

“Please note the unserialization method is not the same as unserialize(). The serialization method is internal to PHP can can be set using session.serialize_handler.”
http://www.php.net/manual/en/function.session-decode.php

Do you have an idea on that ?

By: rommel

rommel — Wed, 28 Dec 2011 16:30:48 +0000

@Phil: As long as you’re using a robust encryption key, your session should remain secure.

By: Phil

Phil — Tue, 06 Dec 2011 02:32:24 +0000

There are tools publicly available to decrypt Suhosin so its not necessarily as secure as you might think. Decrypting Suhosin Sessions and Cookies

By: Dan Ackerson

Dan Ackerson — Thu, 05 May 2011 09:16:04 +0000

Thanks for sharing, Rommel! After a couple hours googling this problem, your blog post saved the day!