Session and cookie information lost when using Flash

Lone

Posted: 17 April 2008 02:25 AM

[ Ignore ]

Research Assistant

Total Posts: 443

Joined 12-13-2007

I just wanted to extend from my previous discussion about session information being lost when using SWFupload - an uploader that uses Flash as a method of uploading a file via HTTP allowing the user to see the progress of the upload.

The reason for the new topic is because this issue relates to the Flash Player in specific rather then just SWFupload. This issue is also related to CI because by default it uses Cookies to handle session information.

I found a great post just recently about this issue on the SWFupload forum but through I would let people on here know about it as well because it will extend to other sites utilising http requests via flash.

Please note this is all just based on my own research.

The Problem - IE
When Flash is used to make a http request to your CI site in IE7 the session for the logged in user/current session is lost. The reason for this is because Flash makes the http request with a different User Agent to IE causing CI to re-issue a new session cookie for Flash.

This looks to be an ok practice but from what I can evaluate Flash uses the IE cookies directory for storage and hence replaces your current IE session cookie with the new one for Flash.

I thought that making the $config[‘sess_match_useragent’] variable set to false would fix this but it doesn’t. Reason being from what I can see is that flash doesn’t at first check if there are any current cookies for it to use for the site and requests a new one from CI.

The Problem - Firefox / others
It seems that there is no problem in Firefox and but there is. The reason why other browsers (in a Windows environment) don’t see these problems is because Flash in these browsers still uses the IE cookies. eg. I log into site with IE and leave it open then open firefox and login and then upload via flash I stayed logged in in Firefox but IE has been logged out.

A possible fix
The first problem to solve is that Flash when uploading doesn’t have a session to give to CI meaning when uploading it’s treated as a new user - not the current user. The way I have worked around this is the usuage of a ‘token’ that is sent as a POST variable (you could use a uri segment) from the first function (where flash is located) to the second function. You could use the session ID but keep in mind that it is changed every few minutes and will be cleared after the issue of the new one. This first fix is really dependant on your own application/database structure.

The second fix needed is to stop the overwriting of this cookie and the best way I have found is to not issue one at all. Personally I do not like the following fix and would like to see some better suggestions but it does work for me for in the meantime.

In your sessions class you need to change the following line in the CI_Session function that is run on object construct:


$this->sess_run();

with

if (! stristr($this->CI->input->user_agent(),'shockwave')) {
    $this->sess_run();
} 

Signature

PX Webdesign | The Lab | Personal Blog

Profile

Merolen

Posted: 25 May 2008 06:23 AM

[ Ignore ] [ # 1 ]

Summer Student

Total Posts: 29

Joined 03-03-2008

Thanks! I agree the last suggested fix isn’t the best, but it works. Have been struggling with this for a couple of hours now

Signature

Love with your heart. Use your head for everything else

Profile

a.somervell

Posted: 27 May 2008 02:39 AM

[ Ignore ] [ # 2 ]

Lab Assistant

Total Posts: 139

Joined 07-31-2006

So what happens when the useragent comes through as “Adobe Flash Player 9” ????

Oh oooooh…

Signature

Andrew Somervell Beer

Profile

a.somervell

Posted: 27 May 2008 03:51 AM

[ Ignore ] [ # 3 ]

Lab Assistant

Total Posts: 139

Joined 07-31-2006

Ok now a couple of hours into this, would LOVE to see your upload code

Signature

Andrew Somervell Beer

Profile

Merolen

Posted: 27 May 2008 04:59 AM

[ Ignore ] [ # 4 ]

Summer Student

Total Posts: 29

Joined 03-03-2008

coming through as Adobe Flash Player 9 won’t make anything happen, but coming through as Shockwave Flash on the other hand I know,it is a security risk, but the security measures should mirror the importance of the website. So I don’t care. Since I use the DB to store session data one could match the IP from the flash session and compare it with the IP of an already logged in user and see if they match, also the last_active could be checked to see if they are at least within e.g 15min of each other.

@a.somervell
Are you talking about the upload code used with SWF uploader?

function upload() {
        $config['upload_path'] = '/path';
        $config['allowed_types'] = 'gif|jpg|png';
        $config['max_size']    = '60';
        $this->load->library('upload', $config);
       
        
        $this->upload->do_upload('Filedata');
        $res = $this->upload->data();
        
        $config['source_image'] = '$src';
        $config['width'] = 600;
        $config['height'] = 600;
        
        
        $this->image_lib->resize();
        
        $this->image_lib->clear();

        $retval = '/image/path.ext;
        echo $retval;
    } 

Signature

Love with your heart. Use your head for everything else

Profile

a.somervell

Posted: 27 May 2008 03:33 PM

[ Ignore ] [ # 5 ]

Lab Assistant

Total Posts: 139

Joined 07-31-2006

It’s a happy man that gets all that working! haha (as I just did)

Signature

Andrew Somervell Beer

Profile

taewoo

Posted: 26 June 2008 01:39 PM

[ Ignore ] [ # 6 ]

Lab Assistant

Total Posts: 287

Joined 01-25-2008

Hmm.. thanks for the posts fellas.
Has anyone gotten this to work with CodeIgniter?

I’ve done the following:

In the controller:

$data["session_id"] = $this->input->cookie($this->db_session->sess_cookie); 
$this->load->view("swfupload", $data); 

In the view

window.onload = function () {
            swfu = new SWFUpload({
                // Backend Settings
                upload_url: "$site_url/swfupload/avatar/",    // Relative to the SWF file
                post_params: {"PHPSESSID": "$session_id"},
....... 

And in the system/libraries/Session

function CI_Session()
    {
        $this->CI =& get_instance();

        log_message('debug', "Session Class Initialized");
        //$this->sess_run();
        if (! stristr($this->CI->input->user_agent(),'shockwave')) {
            $this->sess_run();
        } 
    } 

But the session in the flash and session in my web app don’t correspond to each other (i.e. flash doesn’t seem to think that the user is logged in when in fact the user is)

Signature

http://PawshPal.com/ - Pets Rule

Profile

‹‹ Multiple FIle upload problem fail getting $_GET parameters ››

Username		Remember Me?
Password		forgot password?

Post Marker Legend
	New posts	Hot Topic with new posts	New Poll	Moved Topic	Sticky topic
	No new posts	Hot Topic with no new posts	Old Poll	Closed Topic	Announcements

Visitor Statistics
The most visitors ever was 721, on January 06, 2010 09:38 AM
Total Registered Members:	115007	Total Logged-in Users:	62
Total Topics:	122440	Total Anonymous Users:	4
Total Replies:	647313	Total Guests:	501
Total Posts:	769753