I've been experiencing one of those irritating bugs that you can't replicate. I have an e-commerce site that runs on temporary sessions and mysql, with both the secure and insecure parts on the same server (but under different domains). I pass the PHPSESSID to the secure domain with a GET method (in the URL). In about 10% percent of the orders, though, and in a seemingly random fashion, the PHPSESSID is dropped. Has anyone experienced anything like this? Thanks for any leads you can give!