odd problem with drupal writing PHPSESSID cookies

This is due to this bug in Drupal. http://drupal.org/node/131017

Basically, the settings.php file is specifying the cookie_domain, but you can't specify an IP in the "domain" field of a cookie. So your browser is rejecting the cookie.

If you know how to apply patches, please try the patch I added to the above bug report and post a “follow up” on that issue on whether it worked for you or not.

  - John

Albin.Net : friendly web development

If you know how to apply patches or are willing to learn, it would go a long way to making Drupal better if you reported your success/failure of the patches on those bug reports.

But since applying patches is too complicated for many people, here’s a bit of a hack that will do almost the same thing as the 2 patches I mentioned before:

Change sites/default/settings.php from:

if (isset($_SERVER['HTTP_HOST'])) {
  $domain = '.'. preg_replace('`^www.`', '', $_SERVER['HTTP_HOST']);
  // Per RFC 2109, cookie domains must contain at least one dot other than the
  // first. For hosts such as 'localhost', we don't set a cookie domain.
  if (count(explode('.', $domain)) > 2) {
    ini_set('session.cookie_domain', $domain);
  }
}

to:

if (isset($_SERVER['HTTP_HOST'])) {
  // strip www., IP addresses, and port numbers from HTTP_HOST
  $domain = '.'. preg_replace('`(^www\.|[\d:\.]+$)`', '', $_SERVER['HTTP_HOST']);
  // Per RFC 2109, cookie domains must contain at least one dot other than the
  // first. For hosts such as 'localhost', we don't set a cookie domain.
  if (count(explode('.', $domain)) > 2) {
    ini_set('session.cookie_domain', $domain);
  }
}

/**
 * To prevent cookie collisions, use an unique session name. Session names only
 * accept alphanumeric characters. If you want to share sessions across
 * installations in the same domain, specify the session name by hand.
 */
conf_init();
session_name(preg_replace('`(^https?://|[^a-z\d])`i', '', $base_url));

The use of conf_init() inside the settings.php file is the hackish bit. But, it will work as long as you do NOT set $conf the “Variable overrides” part of settings.php.

  - John

Albin.Net : friendly web development

I have experienced a similar problem with drupal 5.1 and php 5.2 on a debian etch. I have installed it on a server with a private address, accessed from the outside world by means of a NAT on a firewall. When accessing my drupal installation from the private lan (http://192.168.1.102/drupal) server sent a cookie to my browser and I was able to login. When accessing from the outside world (http://neptune.mydomain.it:8080/neptune) server didn't send any cookie and I was not able to login. I have found that deleting this lines in settings.php

if (isset($_SERVER['HTTP_HOST'])) {
$domain = '.'. preg_replace('`^www.`', '', $_SERVER['HTTP_HOST']);
// Per RFC 2109, cookie domains must contain at least one dot other than the
// first. For hosts such as 'localhost', we don't set a cookie domain.
if (count(explode('.', $domain)) > 2) {
ini_set('session.cookie_domain', $domain);
}
}

fix the problem. Now I can login from the inside lan and from the outside world. No sure if this has any side-effect.