Member Avatar for rayne_lynch

hi everyone! I am wondering if anyone can point me in the right direction regarding cookies and sessions. What I need to know is this;
I am developing a website that has mixed html and php pages. I am wanting to have "members" where certain web pages are accessible to them. this is not the problem.
the problem comes when I have a member that is logged in - they are great to surf through ANY of the accessible web pages within the site, however, if they want to visit
an html web page within the site..how can i ensure they are still logged in once they again click on an accessible php page without having to re-log back in? If anyone can point me to a great article or tutorial about how to pull this off, i would be so grateful! I have not been webbing long - but long enough to grasp medium techniques.

  • 2 Contributors
  • 1 Reply
  • 267 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by alan.davies

Dani AI

Generated

Short summary: wanted members to remain logged in when moving between PHP and plain HTML pages. gave the right idea — centralize the login check — but that only works if the page actually runs PHP. Browsers do send the session cookie on every request, yet a static .html file will not execute server-side PHP to validate that cookie.

Practical options (ranked by reliability):

  • Make the pages run on the server (best). Convert the .html files to be served by PHP, or configure the webserver so .html is parsed by PHP. That lets a single include handle the authentication consistently across the site.
  • Keep static files but route them through a PHP controller or use server rewrite rules so requests hit PHP first. This preserves a single, server-side auth check.
  • Use client-side UX checks only as a convenience (not as protection). A static page can call a small PHP endpoint to ask “is this session logged in?” and adjust the UI accordingly; but the server must still enforce auth for every protected resource.

Example client-side check (for UX only):

fetch('/session-check.php', { credentials: 'include' })
  .then(r => r.json())
  .then(data => { if (!data.logged) location.href = '/login.php'; });

Security notes and troubleshooting tips:

  • Never rely solely on client-side checks for access control. Always validate on the server before serving protected data.
  • Use HttpOnly, Secure and appropriate SameSite settings on cookies; regenerate session IDs at login to avoid fixation; keep long-lived “remember me” tokens random and stored hashed server-side; clear both server session and cookie on logout.
  • If cookies seem not to persist, check cookie domain/path, secure flag (HTTPS only), and browser privacy settings.

Recommendation: for simplicity and robustness, serve protected pages through PHP (or a PHP front controller) and keep the centralized include/check approach that suggested.

Member Avatar for alan.davies

The server will store "session cookies" and check against that. It doesn't matter if you do from accessible to limited access pages. Every page should have a 

session_start();

usually at the top of the page before any other output. Then if it's a limited access page...

session_start();
if(!isset($_SESSION['login'])){
    header("http://www.example.com/home");
    exit;
}

Instead of doing thins every single time in your limited pages, I'd use an include file...

includes/limited.php

    if(!isset($_SESSION['login'])){
        header("http://www.example.com/home");
        exit;
    }

your limited pages

session_start();
require "includes/limited.php";
//rest of page
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.