Hacks on Non-VB pages causing duplicate user sessions - Help!

[Tomeeboy]

I just upgraded from vB 1.1.3 to vB 2.0 RC2 tonight and I'm having a weird session problem, which I think is being caused by hacks I have on non-VB pages.

At the moment, I have the user auth system integrated with the entire site. It also displays the visitor's user name on each page, and has a who's online box on each page as well. Global.php is required on every page of the site (to keep track of online visitors, and let visitors use features that are integrated with the VB login system).

While testing the new system with a friend, I noticed that every time he would refresh a page or go to a new page of the site... it would create a new session for him. The result was a sessions table full of sessions for the same user id, and an inflated number of online members. The problem also happens to me when I'm browsing the site, but it doesn't seem to occur with every page load like when my friend is on the site.

The new system hasn't been in place long enough to see if this happens with any other users, but I'm guessing it will.

Anyway, this has me totally stumped, and I'm not sure what would be causing it to create a new session on each page load. If anyone could help, I'd really appreciate it. I've been looking at code and browsing through these forums for the last few hours and have yet to come up with a solution to the problem

Thanks in advance.

-Tom

[Tomeeboy]

anyone? ....... anyone?

[Mike Sullivan]

Sounds like a cookie path issue -- your whole site has to have access to the sessionhash cookie.

[Tomeeboy]

I tried changing the cookie domain value to '.tomeeboy.com' so the whole site could use the cookies. It didn't seem to work though, I'm still seeing multiple sessions being opened for both members and guests :\

Is there something I can do with the cookie save path that might fix it? I'm not exactly sure on what kind of value to set that as.

Thanks,

-Tom

I hade the same type of problem as you on non vbulletin pages, i also use the ./global on every page as you, when you link to the / and whithin the non vbulletinpages remeber to do the links in this way

example:

<a href="pageyouwannalinkto.php?s=$session[sessionhash]">linktext</a>

It solved the problems for me, let me know if it solved your problems

[Tomeeboy]

Hm... there has to be another way to fix it.... It doesn't make sense that the session would have to be passed in every URL, it should be stored in the cookie file (at least I would think so). If you browse vBulletin forums with cookies, it doesn't even put the session in the url.

-Tom

[fruitsalad]

I do something similar on my site. The thing i do different is that I have a seperate version of global.php which is trimmed of a lot of fat not necessary for the non-vb pages. (ie. it is not the global.php from the forum directory)

I do not have the sessions problem that you are describing. Maybe give this a try.