title: Session is lost after an OAuth redirect
body: <p>I use CakePHP 2.4. I have an <a href="http://developer.yahoo.com/oauth/guide/images/oauth_graph.gif" rel="nofollow noreferrer">OAuth signin</a> in my website. %99.5 of signins are successfull but %0.5 fails. I have this error for months. I tried many things to debug and log but still I didn't solve the problem. Although most of the requests are good I need to solve the small part.</p>
  
  <p>Scenario is like this:  </p>
  
  <ul>
  <li>User clicks Sign in button  </li>
  <li>I get request token from server (for example yahoo, twitter)  </li>
  <li>I save <code>oauth_token</code> in user's session<br>
  for example session ID is <code>aaa1234</code></li>
  <li><p>CakePHP creates PHPSESSID cookie and save session id in this cookie. </p></li>
  <li><p>I redirect user to Twitter server and user confirms my application</p></li>
  <li>User comes to my website with oauth verifier<br>
  a) I use user's <code>oauth_token</code> and <code>oauth_verifier</code> and get <code>access_tokens</code>. session ID is <code>aaa1234</code>. everything good.<br>
  b) Failure. Because I can't find user's <code>oauth_token</code> in current session. When I check session ID, I see that ID changed, ID is now <code>bbb2345</code></li>
  </ul>
  
  <p><strong>For the scenario b:</strong><br>
  It seems like user has new session ID now. <code>oauth_token</code> can't be found in new session. But note that old session data exists in <code>/tmp/sessions/</code> folder.</p>
  
  <p>Session ID cookie doesn't exists for session <code>aaa1234</code>. But another tracking cookie that I set 2 days ago exists in cookies.</p>
  
  <p>I check user agents.<br>
  It is same when user first comes and user comes back from Yahoo server.</p>
  
  <p>This failure scenario happens in Chrome, Firefox, mobile browsers or other browsers, so I can't accuse browser type.<br>
  What should I check more to diagnose?</p>
  
  <p>My CakePHP core.php settings:</p>
  
  <pre><code>Configure::write('Session', array(  'defaults' =&gt; 'cake'  ));
  Configure::write('Session.cookie', 'MYPHPSESSID');
  Configure::write('Session.timeout', 120);
  Configure::write('Security.level', 'medium');
  </code></pre>
  
  <p>Other settings are default as mentioned in file: 
  <a href="https://github.com/cakephp/cakephp/blob/2.5/app/Config/core.php#L182" rel="nofollow noreferrer">https://github.com/cakephp/cakephp/blob/2.5/app/Config/core.php#L182</a></p>
  
  <p>Edit: By using <a href="https://stackoverflow.com/questions/8112634/jquery-detecting-cookies-enabled/8112653#8112653">this answer</a> I checked for cookies. 20% of the erroneous users disabled cookies. I asked personally and user confirmed cookie option. But it seems like other users didn't disabled cookies. Also some of users reach my website by using Android WebViews. In WebView clients I'm sure that I don't disable cookies. Also 99% of the WebView users can successfully use website.</p>