I t seems like the only way I can get PEAR Auth to use cookies is with session.use_only_cookies . session.use_cookies was enabled but the URLs were being rewritten by default even though my client was accepting cookies. Kind of vague, I know, but since everthing works fine when I toggle use_only_cookies, I find it strange. Matt