Sessions across secure/non-secure servers

Having one session for two servers

[templar]

Hi,

I am trying to have one session between the secure and the non secure part of my website. I have read some other posts but none of them had exactly what i needed.

Here is what i already know:

1. I have a central database and i have a session handling file.

2. I can't keep the secure and non-secure parts of the website separate because parts of it need to be in the secure area and parts of it don't. I don't really want to put the whole thing through SSL.

3. I need a session_id as soon as a user enters the website, not once the user logs in. The reason is that it is a shopping cart website and hence you need to be able to add things to the cart before login, and each user needs to have their own cart and hence u need the session_id right away.

With all that in mind, the reason its not working is that the secure part of the website is giving the database a new session_id compared to the one at the non-secure site. Why is this happening? Why are they receiving separate session_ids?

I am using the same browser window to access both sites. Does anyone have any ideas on how you could still make this work?

Thanks
Oliver

[rossriley]

Yes this is possible.
How I did it was to make a secure session table in the database, on links from a non-secure to a secure page, insert the session id into the database with all the session data, add the session id to the url. On the secure server get the session data back from the database and initialise the session with the id sent in the url.

Hope this helps
Ross

[templar]

The strange thing that i just realised is that internet explorer works fine but mozilla browsers dont.

Internet explorer keeps the same session id for both the non-ssl and the ssl parts of the website.

For some reason mozilla creates a new one when going to the ssl part of the website.

Does anyone know why this happens?

If not ill have to do the secure database thing :p
Wicked idea dude...i can't believe i didn't think of that!

:D

[templar]

Ok i was wrong...they dont always work on internet explorer either. I guess it depends on the network and the version of the browser.