Member Avatar for cpchc

Hi there - I had written some php for users to login to a password protected part of our site. Today an SSL certificate was installed. Previous to the SSL being installed the pages would timeout and kick the user out to the login screen after a certain period of time. Since the SSL was installed it kicks the user out to the root of the site. The only difference was that I had to change the .htaccess file to route everyone to the https instead of the http. Could this be the error?

The .htacess code is:

RewriteEngine On
RewriteCond %{SERVER_PORT} !443
RewriteRule (.*) https://www.mydomain.com/ [R]

The php code for the timeout (at the beginning of each file in that directory) is:

<?
session_start();
$inactive = 200;
if(isset($_SESSION['start']) ) {
$session_life = time() - $_SESSION['start'];
if($session_life > $inactive){
header("location: https://www.mydomain.com/subfolder/index.php");
}
}
$_SESSION['start'] = time();
if(!session_is_registered(myusername)){
header("location: https://www.mydomain.com/subfolder/index.php");
}
?>
  • 2 Contributors
  • 1 Reply
  • 292 Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by patk570

Dani AI

Generated

Most likely cause: the redirect in your .htaccess is sending every non-HTTPS request to the site root (dropping the original path), so any HTTP→HTTPS hops end up at “/” instead of the subfolder. That plus a mismatch between the cookie domain (www vs non‑www) or secure-cookie settings can make the session appear lost. was right to suggest avoiding hard‑coded hosts, and ’s change to force HTTPS is the place to fix this.

A safer rewrite that preserves host, path and query string while you test:

RewriteEngine On
RewriteCond %{SERVER_PORT} !443
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=302,L]

Use R=302 during testing (switch to R=301 when confirmed). If you have SSL offloading / a proxy, check X‑Forwarded‑Proto instead of SERVER_PORT.

PHP/session fixes to apply (do not use short tags or session_is_registered):

<?php
session_set_cookie_params([
  'lifetime'=>0,'path'=>'/','domain'=>'.example.com',
  'secure'=>true,'httponly'=>true,'samesite'=>'Lax'
]);
session_start();

if (empty($_SESSION['myusername'])) {
  header('Location: /subfolder/index.php');
  exit;
}

if (isset($_SESSION['start']) && (time() - $_SESSION['start']) > 200) {
  session_unset(); session_destroy();
  header('Location: /subfolder/index.php');
  exit;
}
$_SESSION['start'] = time();
?>

Notes and troubleshooting:

  • Use relative redirects (leading slash) to avoid host mismatches.
  • Always call exit after header() so no further output alters behavior.
  • Check cookies & redirect chain in the browser Network tab or with curl -I to verify Set-Cookie and Location headers.
  • Make cookie domain consistent (use .yourdomain.com) or canonicalize requests to a single host (always redirect to one hostname).
  • Consider session_regenerate_id() on login and explicit session_destroy() on timeout.

Fix the rewrite first, test with dev tools, then tighten the session cookie settings — that sequence usually resolves the “kicked back to root” symptom.

Member Avatar for patk570

Do not hardcode the www.mydomain.com/ just use the /subfolder/index.php Since it all attached to the same site and you are already on SSL, all you need to do/use is /subfolder/htmlfile

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.