Passing from HTTP to HTTPS

[stndrdsnz]

I have a PHP application that has to be on http for part of the application, and then move the user to https to do some credit card processing. During the first part of the application the user is writing data to our database, and storing some information in the session so the application can identify the. However, when we move from the http to https side, we can't pass the session along with the user, so we're taking a key from the system and encrypting it and adding it to the URL. When the https side receives the request, it decrypts this data and uses it to lookup the customer's info from the database, and populates the needed session data with that.

This system seems to be working fairly well, except when the customer is on a wifi connection, and then it's hit and miss. Is anyone familiar with wifi technologies, and how that may be causing issues between the customer and the application?

Thanks,

David

[gardnc]

I'd be interested in knowing what "hit or miss" means.

Far as I understand it, there should be no difference on the server's application side between a wired vs. wireless connection. Unless the wireless perhaps uses some algorithm that would cause the page requests to not appear to be coming from the same client each request.

[stndrdsnz]

What I mean when I say Hit or Miss is that it sometimes works and other times it doesn't. We don't see any problems when a customer is on a wired connection. Sometimes a user on a wireless connection works fine, others it doesn't. My assumption at this point is that we are having problems when the customers wireless connection isn't very strong.

It's kind of a complicated thing to describe, but here is the main questions I'm having.

near the start of my application I start the session with the start_session() function.
At what point does the session id get placed on the user's machine as a cookie? Does this happen when the session is started, or at the time I assign a variable to the session?

Is it possible that when my application is sending the session id to the client machine that it gets lost during transmission? If so, would that cause the client to appear not to have a session setup for the request, causing it to dump them back to the beginning?

Thanks,

David