Session variables in non secure to secure sites

[Pat Bremkamp]

I'm having trouble with one of my apps, and I can't figure out why. Sometimes it works and sometimes it doesn't.

The app is an event manager where people select an event on line and preregister and/or prepay on line. In the insecure area, I assign the session variables in the url to a page where I use them to lookup table values and assign more session variables. Then I move to the secure area and use the session variables in the prepayment process. For some people, this works fine, but for some, the session variables are getting "lost" and I'm getting server errors.

Is there a problem with using session variables across an insecure to secure site? Are there security settings some people may have that prevents the variables from being retained?

Pat

[Steve Workings]

Re: Session variables in non secure to secure sites

I do what you describe in one of my sites with no problem, but I'm not juggling as much as you describe. Maybe a better approach would be to write the variables to a table for later use, or use cookies?

[Phil Rolf]

Re: Session variables in non secure to secure sites

Pat,

I ran into the same problem and it drove me crazy. The problem turned out to be that in ONE LOCATION on the website I had the https url entered differently. When this url is encountered, then a NEW SESSION is created, thus your initial session variables are gone.

Example of error
The correct url https://www.prwebgrp.com/.....
Problem url https://prwebgrp.com/....

I hope this helps....

[Pat Bremkamp]

Re: Session variables in non secure to secure sites

Steve and Phil,

Thanks. I think you have me on the trail now.

In my case, users get to my regular site through www.asqpdx.com and I use relative addressing to move from page to page. The event list page is located there.

When someone picks an event, I set the sesson.Ev_Id variable, then check if they are logged in. If not, they go to login then back to the routing page. At that point, they go to http://secure.asqpdx.com/... to get the registration data and make the payment.

Then, if they want another event or to register another person, I'm sending them to http://asqpdx.com/...

So, Phil, you are suggesting that I should be sending them to http://www.asqpdx.com/... instead?

I'll try it.

All of the problems are occurring with people trying to register using their computers at work. I'm thinking that the corporate computers might have cookies disabled. The same person can register successfully from their home computer where, perhaps, cookies are enabled. So I was wondering if there is a difference in the way the session is handled when cookies are disabled. The help says the server tracks sessions using cookies if they are enabled and has to "work harder" if cookies are disabled, but doesn't explain what that means.

Pat

[Phil Rolf]

Re: Session variables in non secure to secure sites

Whatever format you use for the secure site, use it thruout. You can use either format, just as long as they are the same. If you are going to a secure site shouldn't the url start with https ?

[Lenny Forziati]

Re: Session variables in non secure to secure sites

Session variables are host-specific. www.asqpdx.com is not the same as secure.asqpdx.com, so you will never be able to share session variables across them. If you used the same host name for both HTTP and SSL as Phil does, you would be able to do what you want.

-Lenny

[Pat Bremkamp]

Re: Session variables in non secure to secure sites

Thanks to all of you for your help. I've moved everything to the secure area except the home page and now it's working fine.

Pat