How can session_id be passed via headers if a user has disabled cookies, and what are the recommended methods for achieving this?

When a user has disabled cookies, the session_id cannot be passed via cookies. One recommended method to achieve this is to pass the session_id through the headers of HTTP requests. This can be done by setting a custom header with the session_id value and then retrieving it on subsequent requests. 

// Start the session
session_start();

// Generate a session_id if one doesn't already exist
if (!isset($_SESSION['session_id'])) {
    $_SESSION['session_id'] = session_id();
}

// Set the session_id as a custom header
header('X-Session-ID: ' . $_SESSION['session_id']);

// Retrieve the session_id from the headers
$session_id = $_SERVER['HTTP_X_SESSION_ID'];

// Use the session_id to resume the session
session_id($session_id);
session_start();

Keywords

session_id headers cookies disabled recommended methods

Related Questions