Sessions Q - Carrying sessions across URLs?

duckduckgoose

I have written a shopping cart that relies on sessions to store information regarding products & quantities in my customer's cart. Everything works fine, except when I try to checkout, my cart is suddenly empty.

I realized that the shared SSL certificate my webhost provides, which I'm using for the checkout pages, "redirects" to another URL. For example, my site resides on http://www.example.com, whereas the shared SSL pages are located at https://my.webhost.com/example.com/htdocs/filename.php. I believe this is why my cart doesn't carry over when I attempt to checkout. It just appears as an empty cart. Is there a way for me to access the information I set in the $_SESSION variable from the SSL url?

It would be a convoluted and ugly solution to post hidden form variables to the checkout page, and the only other solution I can think of is to get a dedicated SSL certificate. Or, will that present the same problem? I'd like to find a way to just carry the $_SESSION information over to the SSL pages, but I don't know how.

Can someone help?

dalecosp

Is it physically the same server? If so, it might be possible to pass only the session id via either hidden POST var or in the query string, pick it up on the "other" site, and initiate the session on the https server using the same session data.

Otherwise, I'd guess your best bet would be to manage the sessions in your database....

dalecosp

duckduckgoose wrote:
the only other solution I can think of is to get a dedicated SSL certificate. Or, will that present the same problem?

Yes; sort of.

This is exactly the situation that we run into on some servers; Apache can't (last I checked, anyway) do "name-based virtual hosting" for SSL servers (as one might expect), but since it was the same box, a simple reference to the session_id sufficed as the data was still sitting there in /tmp ....