protected static function prepare_cookies() {
        global $CFG;

        $cookiesecure = is_moodle_cookie_secure();

        if (!isset($CFG->cookiehttponly)) {
            $CFG->cookiehttponly = 0;
        }

        // Set sessioncookie variable if it isn't already.
        if (!isset($CFG->sessioncookie)) {
            $CFG->sessioncookie = '';
        }
        $sessionname = 'MoodleSession'.$CFG->sessioncookie;

        // Make sure cookie domain makes sense for this wwwroot.
        if (!isset($CFG->sessioncookiedomain)) {
            $CFG->sessioncookiedomain = '';
        } else if ($CFG->sessioncookiedomain !== '') {
            $host = parse_url($CFG->wwwroot, PHP_URL_HOST);
            if ($CFG->sessioncookiedomain !== $host) {
                if (substr($CFG->sessioncookiedomain, 0, 1) === '.') {
                    if (!preg_match('|^.*'.preg_quote($CFG->sessioncookiedomain, '|').'$|', $host)) {
                        // Invalid domain - it must be end part of host.
                        $CFG->sessioncookiedomain = '';
                    }
                } else {
                    if (!preg_match('|^.*\.'.preg_quote($CFG->sessioncookiedomain, '|').'$|', $host)) {
                        // Invalid domain - it must be end part of host.
                        $CFG->sessioncookiedomain = '';
                    }
                }
            }
        }

        // Make sure the cookiepath is valid for this wwwroot or autodetect if not specified.
        if (!isset($CFG->sessioncookiepath)) {
            $CFG->sessioncookiepath = '';
        }
        if ($CFG->sessioncookiepath !== '/') {
            $path = parse_url($CFG->wwwroot, PHP_URL_PATH).'/';
            if ($CFG->sessioncookiepath === '') {
                $CFG->sessioncookiepath = $path;
            } else {
                if (strpos($path, $CFG->sessioncookiepath) !== 0 or substr($CFG->sessioncookiepath, -1) !== '/') {
                    $CFG->sessioncookiepath = $path;
                }
            }
        }

        // Discard session ID from POST, GET and globals to tighten security,
        // this is session fixation prevention.
        unset($GLOBALS[$sessionname]);
        unset($_GET[$sessionname]);
        unset($_POST[$sessionname]);
        unset($_REQUEST[$sessionname]);

        // Compatibility hack for non-browser access to our web interface.
        if (!empty($_COOKIE[$sessionname]) && $_COOKIE[$sessionname] == "deleted") {
            unset($_COOKIE[$sessionname]);
        }

        // Set configuration.
        session_name($sessionname);
        session_set_cookie_params(0, $CFG->sessioncookiepath, $CFG->sessioncookiedomain, $cookiesecure, $CFG->cookiehttponly);
        ini_set('session.use_trans_sid', '0');
        ini_set('session.use_only_cookies', '1');
        ini_set('session.hash_function', '0');        // For now MD5 - we do not have room for sha-1 in sessions table.
        ini_set('session.use_strict_mode', '0');      // We have custom protection in session init.
        ini_set('session.serialize_handler', 'php');  // We can move to 'php_serialize' after we require PHP 5.5.4 form Moodle.

        // Moodle does normal session timeouts, this is for leftovers only.
        ini_set('session.gc_probability', 1);
        ini_set('session.gc_divisor', 1000);
        ini_set('session.gc_maxlifetime', 60*60*24*4);
    }
protected static function prepare_cookies() {
        global $CFG;

        $cookiesecure = is_moodle_cookie_secure();

        if (!isset($CFG->cookiehttponly)) {
            $CFG->cookiehttponly = 0;
        }

        // Set sessioncookie variable if it isn't already.
        if (!isset($CFG->sessioncookie)) {
            $CFG->sessioncookie = '';
        }
        $sessionname = 'MoodleSession'.$CFG->sessioncookie;

        // Make sure cookie domain makes sense for this wwwroot.
        if (!isset($CFG->sessioncookiedomain)) {
            $CFG->sessioncookiedomain = '';
        } else if ($CFG->sessioncookiedomain !== '') {
            $host = parse_url($CFG->wwwroot, PHP_URL_HOST);
            if ($CFG->sessioncookiedomain !== $host) {
                if (substr($CFG->sessioncookiedomain, 0, 1) === '.') {
                    if (!preg_match('|^.*'.preg_quote($CFG->sessioncookiedomain, '|').'$|', $host)) {
                        // Invalid domain - it must be end part of host.
                        $CFG->sessioncookiedomain = '';
                    }
                } else {
                    if (!preg_match('|^.*\.'.preg_quote($CFG->sessioncookiedomain, '|').'$|', $host)) {
                        // Invalid domain - it must be end part of host.
                        $CFG->sessioncookiedomain = '';
                    }
                }
            }
        }

        // Make sure the cookiepath is valid for this wwwroot or autodetect if not specified.
        if (!isset($CFG->sessioncookiepath)) {
            $CFG->sessioncookiepath = '';
        }
        if ($CFG->sessioncookiepath !== '/') {
            $path = parse_url($CFG->wwwroot, PHP_URL_PATH).'/';
            if ($CFG->sessioncookiepath === '') {
                $CFG->sessioncookiepath = $path;
            } else {
                if (strpos($path, $CFG->sessioncookiepath) !== 0 or substr($CFG->sessioncookiepath, -1) !== '/') {
                    $CFG->sessioncookiepath = $path;
                }
            }
        }

        // Discard session ID from POST, GET and globals to tighten security,
        // this is session fixation prevention.
        unset($GLOBALS[$sessionname]);
        unset($_GET[$sessionname]);
        unset($_POST[$sessionname]);
        unset($_REQUEST[$sessionname]);

        // Compatibility hack for non-browser access to our web interface.
        if (!empty($_COOKIE[$sessionname]) && $_COOKIE[$sessionname] == "deleted") {
            unset($_COOKIE[$sessionname]);
        }

        // Set configuration.
        session_name($sessionname);
        session_set_cookie_params(0, $CFG->sessioncookiepath, $CFG->sessioncookiedomain, $cookiesecure, $CFG->cookiehttponly);
        ini_set('session.use_trans_sid', '0');
        ini_set('session.use_only_cookies', '1');
        ini_set('session.hash_function', '0');        // For now MD5 - we do not have room for sha-1 in sessions table.
        ini_set('session.use_strict_mode', '0');      // We have custom protection in session init.
        ini_set('session.serialize_handler', 'php');  // We can move to 'php_serialize' after we require PHP 5.5.4 form Moodle.

        // Moodle does normal session timeouts, this is for leftovers only.
        ini_set('session.gc_probability', 1);
        ini_set('session.gc_divisor', 1000);
        ini_set('session.gc_maxlifetime', 60*60*24*4);
    }
protected static function prepare_cookies ( ) { global $ CFG ; $ cookiesecure = is_moodle_cookie_secure ( ) ; if ( ! isset ( $ CFG -> cookiehttponly ) ) { $ CFG -> cookiehttponly = 0 ; } // Set sessioncookie variable if it isn't already. if ( ! isset ( $ CFG -> sessioncookie ) ) { $ CFG -> sessioncookie = '' ; } $ sessionname = 'MoodleSession' . $ CFG -> sessioncookie ; // Make sure cookie domain makes sense for this wwwroot. if ( ! isset ( $ CFG -> sessioncookiedomain ) ) { $ CFG -> sessioncookiedomain = '' ; } else if ( $ CFG -> sessioncookiedomain !== '' ) { $ host = parse_url ( $ CFG -> wwwroot , PHP_URL_HOST ) ; if ( $ CFG -> sessioncookiedomain !== $ host ) { if ( substr ( $ CFG -> sessioncookiedomain , 0 , 1 ) === '.' ) { if ( ! preg_match ( '|^.*' . preg_quote ( $ CFG -> sessioncookiedomain , '|' ) . '$|' , $ host ) ) { // Invalid domain - it must be end part of host. $ CFG -> sessioncookiedomain = '' ; } } else { if ( ! preg_match ( '|^.*\.' . preg_quote ( $ CFG -> sessioncookiedomain , '|' ) . '$|' , $ host ) ) { // Invalid domain - it must be end part of host. $ CFG -> sessioncookiedomain = '' ; } } } } // Make sure the cookiepath is valid for this wwwroot or autodetect if not specified. if ( ! isset ( $ CFG -> sessioncookiepath ) ) { $ CFG -> sessioncookiepath = '' ; } if ( $ CFG -> sessioncookiepath !== '/' ) { $ path = parse_url ( $ CFG -> wwwroot , PHP_URL_PATH ) . '/' ; if ( $ CFG -> sessioncookiepath === '' ) { $ CFG -> sessioncookiepath = $ path ; } else { if ( strpos ( $ path , $ CFG -> sessioncookiepath ) !== 0 or substr ( $ CFG -> sessioncookiepath , - 1 ) !== '/' ) { $ CFG -> sessioncookiepath = $ path ; } } } // Discard session ID from POST, GET and globals to tighten security, // this is session fixation prevention. unset ( $ GLOBALS [ $ sessionname ] ) ; unset ( $ _GET [ $ sessionname ] ) ; unset ( $ _POST [ $ sessionname ] ) ; unset ( $ _REQUEST [ $ sessionname ] ) ; // Compatibility hack for non-browser access to our web interface. if ( ! empty ( $ _COOKIE [ $ sessionname ] ) && $ _COOKIE [ $ sessionname ] == "deleted" ) { unset ( $ _COOKIE [ $ sessionname ] ) ; } // Set configuration. session_name ( $ sessionname ) ; session_set_cookie_params ( 0 , $ CFG -> sessioncookiepath , $ CFG -> sessioncookiedomain , $ cookiesecure , $ CFG -> cookiehttponly ) ; ini_set ( 'session.use_trans_sid' , '0' ) ; ini_set ( 'session.use_only_cookies' , '1' ) ; ini_set ( 'session.hash_function' , '0' ) ; // For now MD5 - we do not have room for sha-1 in sessions table. ini_set ( 'session.use_strict_mode' , '0' ) ; // We have custom protection in session init. ini_set ( 'session.serialize_handler' , 'php' ) ; // We can move to 'php_serialize' after we require PHP 5.5.4 form Moodle. // Moodle does normal session timeouts, this is for leftovers only. ini_set ( 'session.gc_probability' , 1 ) ; ini_set ( 'session.gc_divisor' , 1000 ) ; ini_set ( 'session.gc_maxlifetime' , 60 * 60 * 24 * 4 ) ; }
Make sure all cookie and session related stuff is configured properly before session start.
Make sure all cookie and session related stuff is configured properly before session start .