title: Need help passing session using header redirect
body: <p>I am trying to create a 3rd party app for a game I like (EVE Online) which requires oauth.
  I have decided to do the oauth handling in it's own script and once resolved, put an associative array into the session based on the CharacterID retrieved from oauth.</p>
  
  <p>I am able to successfully output the desired contents of the session array from the /callback/index.php' that handles the oauth requests at the end of the script. However, I want to keep this script "in the background" and somewhat secret, and redirect most of the activity to a '../main.php' in the directory just below.</p>
  
  <p>However, when I finally get to main.php, printing the session returns an empty array. What am I doing wrong? I have searched all day for solutions and have implemented every one of them.</p>
  
  <p>Below are the relevant files:</p>
  
  <p><strong>session.php</strong></p>
  
  <pre><code>&lt;?php
      if (!empty($_GET['ID'])) {
          session_id($_GET['ID']);
      }
      if (session_status() == PHP_SESSION_NONE) {
          session_start();
      } else {
          $sLocation="http://eve.oriigen.com/eClt";
          header("Location: ".$sLocation);
          exit();
      }
  
  ?&gt;
  </code></pre>
  
  <p><strong>/callback/index.php</strong></p>
  
  <pre><code>&lt;?php require_once '../src/session.php' ?&gt;
  &lt;?php require_once 'secret.php' ?&gt;
  &lt;?php
  
      function auth_error($error_message)
      {
          print "There's been an error";
          error_log($error_message);
          exit();
      }
  
      $sUserAgent = "EVE Contact List Toolkit [eClt]";
  
      $post_url = "https://login.eveonline.com/oauth/token";
      $get_url = "https://login.eveonline.com/oauth/verify";
  
      $client_id="Basic ".base64_encode($sClientId.":".$sSecretKey);
      $content_type = "application/x-www-form-urlencoded";
      $host_url = "login.eveonline.com";
  
      $aHeaders = array("Authorization: ".$client_id,
                      "Content-type: ".$content_type,
                      "Host: ".$host_url);
  
      $aPostFields = array("grant_type"=&gt;"authorization_code",
                           "code"=&gt;$_GET["code"]);
  
  
      $oCurlRequest = curl_init();
      curl_setopt($oCurlRequest, CURLOPT_URL, $post_url);
      curl_setopt($oCurlRequest, CURLOPT_USERAGENT, $sUserAgent);
      curl_setopt($oCurlRequest, CURLOPT_HTTPHEADER, $aHeaders);
      curl_setopt($oCurlRequest, CURLOPT_POST, count($aPostFields));
      curl_setopt($oCurlRequest, CURLOPT_POSTFIELDS, http_build_query($aPostFields));
      curl_setopt($oCurlRequest, CURLOPT_RETURNTRANSFER, 1);
      curl_setopt($oCurlRequest, CURLOPT_SSL_VERIFYPEER, true);
      curl_setopt($oCurlRequest, CURLOPT_SSL_VERIFYHOST, 2);
      $oResult = curl_exec($oCurlRequest);
  
      if ($oResult===false) {
          auth_error(curl_error($oCurlRequest));
      }
  
      curl_close($oCurlRequest);
  
      $aResponse=json_decode($oResult);
      unset($oCurlRequest);
      unset($oResult);
  
  
      $sTokenType=$aResponse-&gt;token_type;
      $sAuthToken=$aResponse-&gt;access_token;
      $iAuthTokenExpire=$aResponse-&gt;expires_in;
      $sRefreshToken=$aResponse-&gt;refresh_token;
  
      $sGetHeader="Authorization: ".$sTokenType." ".$sAuthToken;
      $oCurlRequest = curl_init();
      curl_setopt($oCurlRequest, CURLOPT_URL, $get_url);
      curl_setopt($oCurlRequest, CURLOPT_USERAGENT, $sUserAgent);
      curl_setopt($oCurlRequest, CURLOPT_HTTPHEADER, array($sGetHeader));
      curl_setopt($oCurlRequest, CURLOPT_RETURNTRANSFER, 1);
      curl_setopt($oCurlRequest, CURLOPT_SSL_VERIFYPEER, true);
      curl_setopt($oCurlRequest, CURLOPT_SSL_VERIFYHOST, 2);
      $oResult = curl_exec($oCurlRequest);
  
      if ($oResult===false) {
          auth_error(curl_error($oCurlRequest));
      }
      curl_close($oCurlRequest);
      $aResponse=json_decode($oResult);
      unset($oCurlRequest);
      unset($oResult);
  
      $sCharId=(string)$aResponse-&gt;CharacterID;
      $sCharacterName=$aResponse-&gt;CharacterName;
      $sExpiresOn=$aResponse-&gt;ExpiresOn;
      $sTokenType=$aResponse-&gt;TokenType;
      $sCharacterOwnerHash=$aResponse-&gt;CharacterOwnerHash;
      $sIntellectualProperty=$aResponse-&gt;IntellectualProperty;
  
  /*    $aCharInfo=array("CharID"=&gt;(int)$sCharId,
                      "CharName"=&gt;$sCharacterName,
                      "CharOwnerHash"=&gt;$sCharacterOwnerHash,
                      "ExpiresOn"=&gt;$sExpiresOn,
                      "AuthToken"=&gt;$sAuthToken,
                      "AuthTokenExpIn"=&gt;$iAuthTokenExpire,
                      "RefreshToken"=&gt;$sRefreshToken);*/
  
      if (!isset($_SESSION[(string)$sCharId])) {
          $_SESSION[(string)$sCharId]=array("CharID"=&gt;(int)$sCharId,
                      "CharName"=&gt;$sCharacterName,
                      "CharOwnerHash"=&gt;$sCharacterOwnerHash,
                      "ExpiresOn"=&gt;$sExpiresOn,
                      "AuthToken"=&gt;$sAuthToken,
                      "AuthTokenExpIn"=&gt;$iAuthTokenExpire,
                      "RefreshToken"=&gt;$sRefreshToken);
      } else {
          $_SESSION["moo"]=0;
      }
  
      session_write_close();
      $sRedirect="../main.php?ID=".session_id();
      header("Location: ".$sRedirect);
      exit();
  
  /*    echo "&lt;pre&gt;";
      print_r($_SESSION);
      echo "&lt;/pre&gt;";
      echo "&lt;hr /&gt;";
      echo gettype($iCharId);
      echo "&lt;hr /&gt;";
      echo "&lt;pre&gt;";
      print_r($aCharInfo);
      echo "&lt;/pre&gt;";*/
  ?&gt;
  </code></pre>
  
  <p><strong>../main.php</strong></p>
  
  <pre><code>&lt;?php require_once './src/session.php' ?&gt;
  &lt;?php
      //echo "SessionId: ".session_id()."&lt;br /&gt;";
      //echo "&lt;hr/&gt;";
      //echo "&lt;pre&gt;";
      print_r($_SESSION);
      //echo "&lt;/pre&gt;";
  ?&gt;
  [ &lt;a href="logout.php"&gt;Logout&lt;/a&gt; ]
  </code></pre>
  
  <p>As you can see from the commented sections, I have tried every diagnostic printout I can think of. So, where am I going wrong?</p>