Symphony.

Issue #309 reintroduced in 2.1.2, so i’ve just copy-pasted description from it.

However, workaround is a different now. Port could be removed with replacing line 45 (i’m not sure about other invocations of getDomain()) in symphony/lib/core/class.session.php with following:

session_set_cookie_params($lifetime, $path, ($domain ? $domain : substr(self::getDomain(), 0, strpos(self::getDomain().":", ":"))), false, $httpOnly);

Here is the original issue description:

PHP’s setcookie, sessionsetcookie_params, etc shouldn’t include port in the cookie domain parameter, since this would not be recognized correctly. Issue can be found with projects on multiple servers, when cookie will be rejected due to different ports on servers.

According to http://www.faqs.org/rfcs/rfc2965.html, set-cookie2 function supports the port parameter. However, i’m not sure about it’s current implementation in PHP, despite some patches in dev’s branch.

It would be good if symphony handled this either by using some set-cookie2 implementation or stripping it from the domain per some symphony configuration option at least.

Currently, in class.session.php, line 83, following code adds port to cookie domain parameter: $domain .= ‘:’ . $parsed[‘port’]. Simple commenting this code resolves the problem.

I believe this issue has already been resolved in the Symphony 2.2 betas.

The getDomain function only works with PHP’s HTTP_HOST which does not include any port information.

As a sidenote, judging by the .git history, this issue should not be in Symphony 2.1.x branch as it was resolved July 2010.

Can you confirm you are using Symphony 2.1.2 and can recreate this issue?

Yep, per my manifest/config.php: ‘useragent’ => ‘Symphony/2.1.2’ Actually, HTTP_HOST is taken from the “Host” HTTP request header, which is filled with port usually if port directly specified in url.

I’ve just double checked: accessing host:port cause filling HTTPHOST with the same “host:port” value, while SERVERNAME gives only hostname.

So, it’s seems like SERVER_NAME is more preferable here.

Interesting, what version of Apache are you running? What port did you use?

I can’t reproduce this locally, I’ve just tried http://symphony.local:80/ and the HTTP_HOST and SERVER_NAME are both the same, with the SERVER_PORT being 80.

I need to double check apache version, but it should be 2.2.15. It’s configured for virtual host with port 801.

Yep, apache 2.2.15.

Thanks, I’ll have a bit more of a poke around with this and see what I can come up with :)