[mortis@voicenet.com: Re: [Pas-dev] newbie: no sessions?]

[Kyle R . B. <mo...@vo...>]

> I'm attempting to set up PAS.  So far, PAS looks like the right
> balance of functionality and simplicity.
> 
> I've got PAS working, mostly.  
> 
> I'm using:
> 
> SuSE Linux 8.0 for x86
> Apache 	 1.3.23 (patched heavily for security problems)
> mod_perl 1.26
> Perl 	 5.6.1
> PAS	 3.0.16 (cannot download 3.0.18 from Source Forge)

I just saw what you mean about 3.0.18 - the release name is pas-3.0.18,
but the .tar.gz file is named 3.0.8.  Regardless, I just released the latest
version [3.0.19], which I'd recommend you use.

> I've installed PAS into /opt/pas.
> 
> All the examples function to the extent that they mostly do the right thing.
> So far, the only thing that appears to be not working are sessions.  I can
> see the session files being created in /opt/pas/session-cache.  But, on pages
> that have session data, I am getting a new one each time.
> 
> For example, Example 2 (sets a timestamp in a session on first use) always
> says "this was the first time you've visited this page,..." and has a new
> timestamp for both the current time and session time each time.
> 
> Did I miss something in the config somewhere?

Perhaps.  In older versions of Pas, you had to set the cookie domain in
the pas.conf file.  The scenario that I think is happening is that Pas
is issuing a cookie for a domain/hostname that is different from what
you are accessing the site as. 

If you are accessing your website as http://localhost/, but [the version of
Pas you are using] thinks that the site's name is 'foo.bar.com', Pas
is trying to set the cookie with that name, and the browser is refusing
to send it back with the next request (which is proper behavior for the 
browser).

Newer versions of Pas default to seting the cookie's domain based on 
the environment (Apache) variable SERVER_NAME, which should match 
the hostname that the web-browser accessed the site as.

If pas.sid.cookie.domain is set in the configuration file, it will override
the value of SERVER_NAME, so the current recommended practice is to not
set that value unless you're having trouble.

I'm not sure what the situation is, but those are some of the issues I've
run into with cookies in the past.

> Oddly enough, I _am_ getting session cookies. I've turned on cookie warnings
> in Mozilla and I am getting cookies sent to me.  However, all the example 
> pages act as if there was no session cookie.

Does the hostname in Mozilla's location bar match the domain the cookie
is being set for?


That's my best guess.


Kyle

-- 

------------------------------------------------------------------------------
Wisdom and Compassion are inseparable.
        -- Christmas Humphreys
mo...@vo...                            http://www.voicenet.com/~mortis
------------------------------------------------------------------------------