Maintaining a session in a session-less environment

The only thing we need to make this work is a unique identifier sent to us on each server call from the client.  Something that is not obvious and cannot easily be guessed; since there is no true security in this process.  The easiest thing to use is the session id that is created by the server on the first visit.  No matter the server-side language, if it supports session it will provide you with a unique session id.  Below is some example PHP code to get our session id:

<?php
$sessionId = session_id();
?>

We will want to retrieve this id on the first page load (usually when we load the Flash application).  The process would be something like this:

<?php
// start our session (assuming auto start is not turned on)
session_start();
// Check if the sessionId was passed in through the URL
if (array_key_exists('sessionId', $_REQUEST)) {
$sessionId = $_REQUEST['sessionId'];
// update our session id to the one passed in
session_id($sessionId);
} else {
// we don't have a session, so store the session id
$sessionId = session_id();
}
?>

On each page request this will look for the session id in the URL or it will generate a new one.  After this process we would pass the $sessionId to Flash so they can send it back each time allowing us to maitain our session in a session-less environment.

You may have noticed that this is an incomplete example because we haven't stored anything in our session to maintain.  To make this example complete, we will want to retrieve the "current user" from our database.  In the else statement above, we would need to perform a query to retrieve the user.  Once retrieved, we can store the user in the session and use it on each subsequent call when our session is already set.

Have I confused you even more?  Below is a stripped down example of doing this with an iframed Facebook application:

<?php
// start our session (assuming auto start is not turned on)
session_start();
// Check if the sessionId was passed in through the URL
if (array_key_exists('sessionId', $_REQUEST)) {
$sessionId = $_REQUEST['sessionId'];
// update our session id to the one passed in
session_id($sessionId);
// get the user from the session
if (array_key_exists('user', $_SESSION)) {
$user = $_SESSION['user'];
} else {
// something went wrong and we don't have a session, so send them back to the main canvas page to re-intialize everything...
echo '<script>window.top.location="http://apps.facebook.com/<myapphere>";</script>';
exit;
}
} else {
// we don't have a session, so store the session id
$sessionId = session_id();
// validate Facebook request variables
$userId = validateFacebook();
// query database for user
$user = fakeFunctionToGetOurUser($userId);
// store this in the session
$_SESSION['user'] = $user;
}
function validateFacebook() {
// perform $_REQUEST check
if (array_key_exists('fb_sig', $_REQUEST)) {
// TODO: place code that validates the $_REQUEST params
return $_REQUEST['fb_sig_user'];
} else {
// something went wrong and we don't have a session and don't have our Facebook
// request variables, so send them back to the main canvas page to re-intialize everything...
echo '<script>window.top.location="http://apps.facebook.com/<myapphere>";</script>';
exit;
}
}

I hope that helps clear things up.  For those of you out there who are looking for a more completed Facebook iframed example, I hope to have that soon.  Enjoy!

Published on Jan 17, 2011

Tags: Facebook | session | PHP