Secure Server Question

jtonsfeldt

I have developed a PHP based shopping cart for a small store. I have been having trouble passing session variables from HTTP to secure HTTP. So I have two questions:

1 Are there any disadvantages to running the entire site on HTTPS?

2 Is there a method for sending session information to the secure server?

Thanks so much

big_nerd

Site Speed & Much Higher Bandwidth Usage
Yes, pass the session ID, its probably not being passed as the cookie isnt being picked up, try passing the session ID via POST or GET (dependant on how you send them to the https server)

$currentSessionID = session_id(); // grab the current session id


// in https
$sessionID = $_POST['SSID'];
session_id($sessionID); // set the session id

make sure you have session_start() before that on the https section.

NogDog

jtonsfeldt;10933424 wrote:
I have developed a PHP based shopping cart for a small store. I have been having trouble passing session variables from HTTP to secure HTTP. So I have two questions:

1 Are there any disadvantages to running the entire site on HTTPS?

From what I've read, it's not always cut and dried that it hurts overall performance: there are a lot of variables that go into the equation. For example, see A Performance Analysis of Secure HTTP Protocol. Ultimately you can only answer this question for sure by thorough performance testing.

2 Is there a method for sending session information to the secure server?

I've usually seen this issue with "shared" SSL certificates, due to the shared certificate actually existing on a different domain than the web site. Sending the session ID via post/get as mentioned above is probably the best solution I can think of if you (i.e. the client) are not willing to purchase your own site-specific SSL certificate.

jtonsfeldt

Thanks for the responses.

According to the PHP website, it looks like session ids may only be passed via GET or a cookie. I have been unable to successfully maintain the session by posting the session id, so my experience suggests this is correct and POST will not work. I guess I will try a cookie...

Here is the link I am referencing: http://php.net/manual/en/session.idpassing.php

Weedpacket

Oh, you can provide it however you like; using it is just a matter of passing it to [man]session_id[/man]. That's done automatically if it's provided in a GET or in a cookie; but the manual route is there. Then [man]session_start[/man] as normal.