0

I'm currently using the following JavaScript to send POST data to a website of mine:

example1.com:

function buttonFunction() { $.post("http://example2.com/core/file.php",{username:username, password:pword, coins:coins}, function(data) { // Stuff }); } 

Then within file.php on example2.com I have the following to save and read a session:

<?php namespace Penguin; session_start(); if(isset($_SESSION['money_maker'])) { echo "Cannot run."; } else { $_SESSION['money_maker'] = getmypid(); echo $_SESSION['money_maker']; echo "Running."; } header('Access-Control-Allow-Origin: http://example1.com'); header('Access-Control-Allow-Credentials: true'); header('Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS'); header('Access-Control-Max-Age: 1000'); header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With'); date_default_timezone_set('America/New_York'); error_reporting(0); // REST OF THE PHP CODE ?> 

As one can see, I set a session (if one has not already been set), and then if the session is already set, the script will echo "Cannot run."

However, the script never echos "Cannot run." even if I set the session on the previous AJAX run. In other words, the session is not being "saved." It always outputs "Running."

HOWEVER, in /var/lib/php5 it seems like the session files are being created, yet there are no cookies for the session in my browser. So when I try to test against $_SESSION['money_maker'] in my PHP file, it always outputs that it is NOT set. Any help?

EDIT 1:

It seems like the problem lies in the AJAX request. When I tried to run the script directly, the session was saved perfectly fine (and the cookie was created). It seems like when I try to send a POST request to the PHP file via AJAX from my different domain, the session is set (a session file is created in /var/lib/php5), but the cookie for the session is not created.

With that being the case, is there any fix?

5
  • One thing I immediately notice is that in your example, you state that you are making an AJAX call from example1.com, however your AJAX url is for example2.com. Are you in fact attempting to make a cross-domain AJAX request, or is that a typo? Commented Jul 23, 2014 at 13:52
  • @oliakaoil Yes, I am trying to make a cross-domain AJAX request (I also have control over example2.com). I have referenced this a bit in my first edit. Commented Jul 23, 2014 at 13:53
  • Read this: stackoverflow.com/questions/14462423/… Commented Jul 23, 2014 at 13:55
  • @oliakaoil Ahh, so how can I use the Set-Cookie header? If I use that, I can fix this issue, correct? Commented Jul 23, 2014 at 13:59
  • Skimming this: developer.mozilla.org/en-US/docs/Web/Security/…, and this: stackoverflow.com/questions/3076414/…, I believe you cannot set a cookie for a domain other than the current site. Commented Jul 23, 2014 at 14:04

0

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.