Cookieless Sessions

In Moodle 1.6 we've added support for cookieless sessions to Moodle. The code will need testing in the different modules to check that it works in all areas of a site. You can test it by turning cookies off in your browser or disallowing cookies just for your Moodle site. Post any bugs you find here : http://moodle.org/bugs/bug.php?op=show&bugid=4504&pos=1

Cookieless sessions work by appending a session id to every url or to hidden form fields in forms in html pages so that php can track sessions. When cookieless sessions are turned on then code in lib/cookieless.php will automatically add session ids in the absence of cookies. The code will fail though when javascript is used to jump from page to page. So when using javascript to jump to a new page then you can call a function in lib/cookieless.php to add session ids to the URL, as follows :

   if (!empty($CFG->usesid) && !isset($_COOKIE[session_name()])) {
       $attempturl=sid_process_url("attempt.php?id=$cm->id");
   } else {
       $attempturl="attempt.php?id=$cm->id";
   };

You don't need to include cookiless.php it will have been included already if needed.

Enable cookieless sessions by including $CFG->usesid=true; in config.php. Based on code from php manual by Richard at postamble.co.uk

Attempts to use cookies if cookies not present then uses session ids attached to all urls and forms to pass session id from page to page. If site is open to google, google is given guest access as usual and there are no sessions. No session ids will be attached to urls for googlebot. This doesn't require trans_sid to be turned on but this is recommended for better performance you should put session.use_trans_sid = 1 in your php.ini file and make sure that you don't have a line like this in your php.ini: session.use_only_cookies = 1

author Richard at postamble.co.uk and Jamie Pratt license http://www.gnu.org/copyleft/gpl.html GNU Public License