Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bug: Ajax request makes the session expire when app.sessionExpiration is set to 0 #5688

Closed
rfikree92 opened this issue Feb 13, 2022 · 4 comments · Fixed by #5779
Closed

Bug: Ajax request makes the session expire when app.sessionExpiration is set to 0 #5688

rfikree92 opened this issue Feb 13, 2022 · 4 comments · Fixed by #5779
Labels
bug Verified issues on the current code behavior or pull requests that will fix them

Comments

@rfikree92
Copy link

PHP Version

7.4

CodeIgniter4 Version

4.1.8

CodeIgniter4 Installation Method

Composer (using codeigniter4/appstarter)

Which operating systems have you tested for this bug?

Linux

Which server did you use?

apache

Database

No response

What happened?

I have made an ajax script that keeps checking if the user session is valid or not and then it print to console if the session is expired

<script> 
      $(document).ready(function() {
        var checkSession;
        function CheckForSession() {
          jQuery.ajax({
            url: '<?= site_url('password/checksession'); ?>',
            headers: {'X-Requested-With': 'XMLHttpRequest'},
            type: "POST",
            cache: false,
            success: function(result) {
              if (result.sessionStatus == "0") {
                console.log('Your session has been expired!');
              }
            }
          });
        }
        checkSession = setInterval(CheckForSession, 5000);
      });
</script>

and this is the controller/method

public function checkSession()
    {
        if (!session()->has('user_id')) {
            $data = [
                'sessionStatus' => 0
            ];
        } else {
            $data = [
                'sessionStatus' => 1
            ];
        }
        return $this->response->setJSON($data);
    }

this script works only one time then in the browser console i see this warning message "Cookie “ci_session” has been rejected because it is already expired."

I tried to see whats causing this error and reached to this commit which changed how setCookie() method works, the old code works with my ajax requests but the new one doesn't, one thing i did was changing
cookies([$this->cookie], false)->dispatch(); to cookies([$this->cookie], true)->dispatch(); so it doesn't create a new instant of CookieStore and it worked again.

I am not sure why the author used "false" so i am not sure if my changes are proper or not.

Steps to Reproduce

I assume doing any ajax request to any controller should make the session expire

Note: app.sessionExpiration should be set to 0 for the error to be reproduced

Expected Output

session doesn't expire when doing ajax requests

Anything else?

No response
@rfikree92 rfikree92 added the bug Verified issues on the current code behavior or pull requests that will fix them label Feb 13, 2022
@kenjis
Copy link
Member

kenjis commented Feb 13, 2022 •
edited
Loading

Can't reproduce in develop.
I get {"sessionStatus":1} all the time.

--- a/app/Config/App.php
+++ b/app/Config/App.php
@@ -174,7 +174,7 @@ class App extends BaseConfig
      *
      * @var int
      */
-    public $sessionExpiration = 7200;
+    public $sessionExpiration = 0;
 
     /**
      * --------------------------------------------------------------------------
<?php

namespace App\Controllers;

class Home extends BaseController
{
    public function index()
    {
        session()->set('user_id', 1);

        return <<<'EOL'
            <!DOCTYPE html>
            <html lang="en">
            <head>
            <script src="https://code.jquery.com/jquery-3.6.0.min.js" integrity="sha256-/xUj+3OJU5yExlq6GSYGSHk7tPXikynS7ogEvDej/m4=" crossorigin="anonymous"></script>
            <script>
                  $(document).ready(function() {
                    var checkSession;
                    function CheckForSession() {
                      jQuery.ajax({
                        url: 'http://localhost:8080/home/checksession',
                        headers: {'X-Requested-With': 'XMLHttpRequest'},
                        type: "POST",
                        cache: false,
                        success: function(result) {
                          if (result.sessionStatus == "0") {
                            console.log('Your session has been expired!');
                          }
                        }
                      });
                    }
                    checkSession = setInterval(CheckForSession, 5000);
                  });
            </script>
            </head>
            <body>
            </body>
            </html>
            EOL;
    }

    public function checksession()
    {
        if (!session()->has('user_id')) {
            $data = [
                'sessionStatus' => 0
            ];
        } else {
            $data = [
                'sessionStatus' => 1
            ];
        }
        return $this->response->setJSON($data);
    }
}

@kenjis kenjis removed the bug Verified issues on the current code behavior or pull requests that will fix them label Feb 13, 2022
@rfikree92
Copy link
Author

@kenjis can you try to use the .env file and set "app.sessionExpiration = 0" because only then it would expire i tried to set the sessionExpiration in /app/Config/App.php as you did and it worked fine, btw i am using the develop branch now

@kenjis
Copy link
Member

kenjis commented Feb 13, 2022 •
edited
Loading

@rfikree92 Oh! It reproduced.

The first Ajax request got:

Set-Cookie: ci_session=nqf9qi44tf37141ram6iafbgv7ktlfbd; expires=Sun, 13-Feb-2022 09:34:18 GMT; Max-Age=0; path=/; HttpOnly; SameSite=Lax

But when I don't set app.sessionExpiration = 0 in .env:

Set-Cookie: ci_session=4r8pq8m94bfjv6kimq483124hm92g3kl; path=/; HttpOnly; SameSite=Lax

@kenjis
Copy link
Member

kenjis commented Feb 13, 2022

When I set app.sessionExpiration = 0 in .env, $config->sessionExpiration is "0".

@kenjis kenjis added the bug Verified issues on the current code behavior or pull requests that will fix them label Feb 13, 2022
@kenjis kenjis mentioned this issue Feb 13, 2022
Closed
3 tasks
@rfikree92 rfikree92 mentioned this issue Feb 13, 2022
Closed
5 tasks
@paulbalandan paulbalandan mentioned this issue Feb 17, 2022
Closed
5 tasks
@kenjis kenjis mentioned this issue Mar 6, 2022
Merged
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Verified issues on the current code behavior or pull requests that will fix them
Projects
None yet
Milestone
No milestone
2 participants
@kenjis @rfikree92