php - iframe looses session on redirection in Chrome

Question

I need a help with a problem I don't know how to fix. The issue I have is the when I nest another pager in iframe and that iframe redirects within it self, it looses the session data.

So the scenario is like this:

• index.php with nested iframe =>

  <iframe src="http://somedomain/global.php?user=someuser&site=1234567" style="width:100%;height:100%;border:0px;"></iframe>

• global.php file on another domain that creates session and session exists =>

  $sess_path = '/somepath/';
  session_save_path($sess_path);
  ini_set('session.cookie_samesite', 'None');
  session_start();
  $_SESSION['user'] = $_GET['user'];
  $_SESSION['site'] = $_GET['site'];
  header('location: ../home.php');
  

• within iframe global.php file redirects to home.php and session info is lost

  $sess_path = '/somepath/';
  $sess_timeout = 30;
  ini_set('session.gc_maxlifetime', $sess_timeout);
  ini_set('session.cookie_lifetime', $sess_timeout);
  ini_set('session.cache_expire', $sess_timeout);
  ini_set('session.gc_probability', 100);
  ini_set('session.gc_divisor', 100);
  session_save_path($sess_path);
  ini_set('session.cookie_samesite', 'None');
  session_start();
  

• if I print_r $_SESSION it's empty

I have searched around and found some answers but was unable to make it work (I'm pretty sure I'm not understanding something). First of all my app is based only on Chrome browser and I have found out that chrome now changed something in regards to handling the 3rd part redirections. I have added ini_set('session.cookie_samesite', 'None'); to both global.php and home.php but that made no difference.

If I try my test setup on Firefox it works as intended, so this only makes me to conclude it is something to do with Chrome

Could I ask for some idiot proof instruction on how to fix this problem?

Thank you

question from:https://stackoverflow.com/questions/65933590/iframe-looses-session-on-redirection-in-chrome

Answer 1

Managed to fix my issue by making my website and target website https, now all works fine after adding the two ini settings in global.php:

    ini_set('session.cookie_samesite', 'None');
    ini_set('session.cookie_secure', 1);

KIKO Software thank you for the suggestion.