This question is posting after trying many solutions for about past 2 days and nothing is worked. Session in my Codeingiter 4 project behaving in a strange manner. There is a payment module in my application and PayU is my payment gateway provider. After the payment gateway redirection PayU will post some response data in my URL. At this time session destroys automatically. I don’t know why and for your understanding it’s happening becasue it’s not happening everytime, say out of 10 session will destroy 7 time after the successfull payment. I get all the response from the PayU inside my controller. If the payment is cancelled by the use the frequency is about 5 out of 10 tries. This issue is only happends after redirection from PayU payment gateway irrespective of the payment status. I tried this,this,this,this and many other sites other than in StackOverflow.
I’m using Open LiteSpeed server in AlmaLinux 8. I added this in my virtual server config file
context / {
location $DOC_ROOT/
allowBrowse 1
extraHeaders header edit set-cookie $1;httponly;secure;samesite=none
}
My htaccess file doesn’t contain anything other than a rewrite rule for hiding public from URL.
This is my .env
app.sessionDriver = 'CodeIgniterSessionHandlersDatabaseHandler' // Initially it was FileHandler
app.sessionCookieName = 'ci_session'
app.sessionExpiration = 7200
app.sessionSavePath = ci_sessions
# app.sessionMatchIP = false
app.sessionTimeToUpdate = 300
# app.sessionRegenerateDestroy = false
# app.CSPEnabled = false
// Initially all the cookie preferences are commented out experimented with different values.
cookie.prefix = ''
cookie.expires = 7200
cookie.path = '/'
cookie.domain = '<domain_name>'
cookie.secure = true
# cookie.httponly = false
cookie.samesite = 'none' // I tried Lax also
# cookie.raw = false
security.csrfProtection = 'cookie'
security.tokenName = 'csrf_token_name'
security.headerName = 'X-CSRF-TOKEN'
security.cookieName = 'csrf_cookie_name'
security.expires = 7200
security.regenerate = true
security.redirect = true
security.samesite = 'Lax'
curlrequest.shareOptions = true
I tried this in my BaseController
public function initController(RequestInterface $request, ResponseInterface $response, LoggerInterface $logger)
{
// Do Not Edit This Line
parent::initController($request, $response, $logger);
// Preload any models, libraries, etc, here.
$this->session = ConfigServices::session();
session();
}
I added this line in my php.ini
session.auto_start = 1
After the payment PayU will post response to this function
I’m using PHP 7.4, Codeigniter 4.1.5 and Litespeed 1.7.14.
Update
I updated Codeingiter version to 4.2.3 latest version but there is no heal for this issue.
2
Answers
The reply given from PayU is,
TL;DR - In Chrome v.84 SameSite cookie attribute is released which if not handled by the server may lead to an issue causing loss of session data or session ID gets NULL.The issue where cookies are getting NULL in return journey is occurring with chrome browser 84+ version.There is no restriction from PayU's end as such for cookies .
Solution Suggested:The chrome 84 security update says that SameSite attribute of cookie will be Lax(allowed for GET requests) by default and if we want cookie to travel then it should be marked SameSite : None and "Secure" explicitly. (Ref. https://web.dev/samesite-cookies-explained/
Make following changes.
in config/cookie.php page set
$secure = true ;
$samesite = ‘None’;
in config/security.php set
$samesite = ‘None’;
Then give absolute path as redirect url:
eg: domain.com/customer/Pay/checkTransaction