transfering session data from one server to another

[kknusa]

Hello guys

Is there any neat way to transfer the session data from a server A to a server B . Server A is an https server whereas B is a http server?

thnks

[figment88]

You can use redirects or you can write the sessionid into the page as parameters on a image tag.

For example, Server A would spit out a page with

<img src=http://www.serverB.com/bug.php?sessionid=XXXX>

XXXX equals the session ID on server A, bug.php is a script on server B (PHP in this case but could use ASP, Java, coldfusion,etc.) that records the session ID and then spits out a transparent pixel.

There is also a way to use JavaScript that avoids spitting out the image which I think (but haven't tried) can avoid the security warning for mixing security levels.

[httpwebwitch]

hey, that's neat!

When you call a php page as the src of an image, does it always send a transparent pixel as output? Or is that a special trick?

That's the method used by WebTrends to track info about a page and the user loading it. They construct the link with Javascript on the client side, so that the browser info can be captured as well.

Can you provide more detail about how this method can be used?

[figment88]

No PHP doesn't spit out a pixel image, but you can fake one. I originally copied this from PHPOpenTracker.

<?php
//All you tracking and logging, etc.

//Spit out pixel
header('Content-type: image/gif');
header('Expires: Sat, 22 Apr 1978 02:19:00 GMT');
header('Cache-Control: no-cache');
header('Cache-Control: must-revalidate');

printf("%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%",
71,73,70,56,57,97,1,0,1,0,128,255,0,192,192,192,0,0,0,33,249,4,1,0,0,0,0,44,0,0,0,0,1,0,1,0,0,2,2,68,1,0,59);

?>

I usually use JavaScript and just source an image, so nothing needs to be displayed. The user needs to have JS, though.

<script>
var bug=new Image();
bug.src=pix.php?var1=var;
</script>

[jamesa]

But if it's an https page and the image is served via http then most browsers by default will display a warning about the security of the page. Cleanest way is to set up https on the http domain.