Session: New ID generated every time, can't load existing ID from URL

Questions Components & MVC
1

I have a problem. My frontend is in one domain and my backend is in another domain.

When calling the backend, a new session ID is generated every time. I assume it’s because the backend is in a different domain and the browser is not sending the PHP cookie PHPSESSID.

So I’m trying to manually send the PHPSESSID in the URL and load it in the backend:

    $query = $request->getQueryParams();
    $smgr = $this->sessionManager;
    if ($smgr->sessionExists()) {
        if ($smgr->getId() !== $query['PHPSESSID']) {
            $smgr->destroy();
            $smgr->setId($query['PHPSESSID']);
        }
    }
    $smgr->start();
    $sc = new Laminas\Session\Container();

However, the session data is not loaded. How can I make it load the existing data in another session ID?

I checked and the session file saved by PHP contains the data I expect:

$ cat /var/lib/php/sessions/sess_vnd69t0fv5kffsp8beiqg6s8q2
__Laminas|a:2:{s:20:"_REQUEST_ACCESS_TIME";d:1593974921.636022;s:6:"_VALID";a:1:{s:28:"Laminas\Session\Validator\Id";s:26:"vnd69t0fv5kffsp8beiqg6s8q2";}}Default|C:26:"Laminas\Stdlib\ArrayObject":254:{a:4:{s:7:"storage";a:1:{s:12:"oauth_return";s:21:"http://localhost:8071";}s:4:"flag";i:2;s:13:"iteratorClass";s:13:"ArrayIterator";s:19:"protectedProperties";a:4:{i:0;s:7:"storage";i:1;s:4:"flag";i:2;s:13:"iteratorClass";i:3;s:19:"protectedProperties";}}}
2

One workaround I found now is this: Disabling session.use-only-cookies in php.ini

https://www.php.net/manual/en/session.configuration.php#ini.session.use-only-cookies

3

In session config you set cookie_secure is false