Session on different subdomains, how?

Question

PHP

Hello.
A request is sent from the example.com domain to api.example.com/?login, and a user session is created on api.example.com.
you need to have this session on api.example.com, but also check for it on example.com and example.com/my to control whether it's logged in or not.
I tried to insert before opening the session: What, in theory, should work on api. and www. but doesn't work. even on api. on a subsequent call, the session is lost. The explanation is "lost": when there is a login from the domain, the api successfully creates a session, and sends me the session ID for debugging. If I open the api directly, a new session is created with a different id. I tried it too . Thanks in advance. ini_set('session.cookie_domain', '.example.com' );
session_set_cookie_params(0, '/', '.example.com');

Answer 1

I read it, well ... and the chest just opens)
In .htaccess we insert on all subdomains:
The session handler for all subdomains in this case must be the same
or it is necessary to configure session transfer between different hosts.

Answer 2

session_regenerate_id(true);
php.net/manual/en/function.session-regenerate-id.php

Answer 3

I recently solved this kind of issue.
It is necessary that cookies with the session id be available for subdomains, that is, .example.com, as you wrote, then when sending a request from example.com to api.example.com, it is better to use curl and insert cookies with the name PHPSESSID and the value from the cookie into the request body which is generated on api.example.com and available to example.com

Answer 4

define('SITE_SES_DOMAIN', '.exemple.ru');//domain name for sessions and subdomains
define('SITE_SES_TIME',60*120);// session lifetime, 30 minutes (60*30)
It worked for me when such parameters + sessions are stored in the database
ini_set('session.gc_maxlifetime', SITE_SES_TIME);
ini_set('session.cookie_lifetime', 0); // 0 - the cookie dies when the browser is closed
ini_set('session.cookie_domain',SITE_SES_DOMAIN);
session_set_cookie_params(SITE_SES_TIME,"/",SITE_SES_DOMAIN);
setcookie('PHPSESSID',session_id(),0,"/",SITE_SES_DOMAIN);