switching session variables between http and https

If you don't want to use Cookies and can't use Session, you've got a stateless application.  Feh.

Do what PayPal does - put everything behind HTTPS.  Redirect anybody that uses http right over the wall.
No more security worries and no coding hassles.  Those guys at PayPal are pretty smart about this stuff!

HTH, ~Ray

// IF NOT HTTPS
if (empty($_SERVER["HTTPS"])) { 
 
// ESTABLISH WHERE I ENTERED THE SITE
   $my_entry_uri = 'https://' . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"];
 
// GO TO SECURE SIDE
   header("Location: $my_entry_uri")
   exit;
}
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:

Thanks for the quick response.

hernst42 - I believe I am using my secure server correctly. The domains follow this format:

http://www.mydomain.com
https://secure.mydomain.com

The session variables are not moving from one area to the other.

Ray_Paseur: I appreciate that keeping within the https would theoretically solve my problems, but this not the correct way to do things, as far as I know. For one thing is slows things down and makes use of https and security certificate where it is not needed.

I would really like to try and achieve something similar to say,  how things are done on this site or on Amazon or on any professional site that switches between the two.

Thanks.

That's fine - but it puts you into the world of Cookies and Data Base Sessions.  It's not that it can't be done by any means, it's just another step in the planning process for each page header and each modification of the Session data.

This does not work, as its not the same hostname (www!==secure). You can try this:

session_set_cookie_params(0, '.mydomain.com');
session_start();

So the cookie for the session is available for both urls
http://www.mydomain.com
https://secure.mydomain.com

If I were to use the database sessions, the problem I have is there still needs to be some kind of interlinking variable. Am I correct in thinking that I will need to use a cookie to link the two? And if I do that is just using cookies just as "safe"?

The cookie is the interlinking variable.  Here's what I do...

Check a flag to see if the user said "Remember Me" - loong term cookie if so.
Assign a hash string (camp_cookie).
Assign a name.
Assign a path of '/' so the cookie is available to the entire domain.
Assign a domain starting WITHOUT the www prefix to make the cookie available on all subdomains
Assign secure = FALSE so the cookie is sent to http and https both
Assign http = TRUE to help keep the cookie out of the hands of Javascript.

Man Page Here:
http://us3.php.net/manual/en/function.setcookie.php

Then you can use the hash string to access stored variables in the data base.  Does that makes sense?

// SET A COOKIE TO REMEMBER THE LOGIN?
	if ($cFlag == '') {
		$cookie_expires	= 0; // EXPIRE AT END OF SESSION
	} else {
		$cookie_expires	= time() + 6*60*60 + $my_cookie_life;  // +6 HOURS FOR GMT (SERVER IN CENTRAL TIME)
	}
	$cookie_value	= $_SESSION["camp_cookie"];
	$cookie_name 	= "$my_login_cookie";
	$cookie_path	= '/';
	$cookie_domain	= str_replace('www', '', strtolower($_SERVER["HTTP_HOST"])); // STARTS WITH DOT
	$cookie_secure	= FALSE;
	$cookie_http	= TRUE;
	if (!setcookie($cookie_name, $cookie_value, $cookie_expires, $cookie_path, $cookie_domain, $cookie_secure, $cookie_http)) { /* echo "Cookie Failed"; */ }
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:

use proper settings for session_set_cookie_params and you don't need you own cookie or database sessions.

@hernst42, I guess it would be an application-dependent choice - whether you needed cookies or database state information. I need some cookies to outlive the browser session, so I had to set my own cookies anyway - the "welcome back" type.  In the process of researching it, I came to the conclusion that my code library should look like the snippet above for the kinds of cookies that I wanted in http and also in https.  I have always found cookies to be useful app design elements, beyond just keeping session state.  But the Asker said he did not want to use cookies, and I take him at his word.  However, if I were in his position, I would be tempted to just put everything behind HTTPS and be done with the issue.  More than one way to skin the cat, for sure.

Best to all, ~Ray

Hi, thanks for the continued advise. If use the session_set_cookie_params how would integrate this into my current code. I am having some trouble. The following is the code I have, I am probably being too simplistic trying to get it to work like it did, and I am probably missing the point! Perhaps you can suggest a solution. Thanks...

//---------------------------------------------------------------------
//---------------------------------------------------------------------
 
//the code below is on the page that the login page goes to when the submit button is pressed...
 
include("../private/[databaseinfofile]");
mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database...");
 
require_once('CU.php');
require_authentication_frontend();
 
...
 
session_set_cookie_params(0, '.mydomain.com');session_start(); 
// added suggested line above
 
$_SESSION['name'] = "MY_SESSION_NAME";
 
//create the session variables and other variables
$_SESSION['user_id'] = $record['forename']." ".$record['surname'];
$_SESSION['level'] = $record['level'];
$_SESSION['email'] = $record['email'];
$_SESSION['sess_id'] = session_id();
$_SESSION['agent'] = md5($_SERVER['HTTP_USER_AGENT']);
$ipaddress=$_SERVER['REMOTE_ADDR'];
$customeremail=$_SESSION['email'];
$sessionid=session_id();
 
//update the customer's login-info with number of attempts
$sql="UPDATE customers SET session_id='$sessionid'....[otherstuff put in db too]...WHERE email='$n'";
mysql_query($sql);
 
...
 
//---------------------------------------------------------------------
//---------------------------------------------------------------------
 
//CU.php
//The following is what is on CU.php
//CU.php is called on every page...
 
 
session_set_cookie_params(0, '.mydomain.com');session_start(); 
// added suggested line above
session_start();
 
/**
 * this redirects a non-logged in user to login.php
 * if logged in, nothing happens...
*/ 
 
function require_authentication_frontend() 
{
 
  global $custName;
  
  $_SESSION['name'] = "MY_SESSION_NAME";
  $ok=true;
  
  if (!isset($_SESSION['agent']) OR ($_SESSION['agent'] != md5($_SERVER['HTTP_USER_AGENT'])) ) 
  {
  $ok=false;
  }
  
  if ($ok)
  {
  
    if(isset($_SESSION['user_id'])) 
    {
    	
    	$custName=$_SESSION['user_id'];
    	if ($custName=="") 
    	{
    		
    		$_SESSION = array();
    		$custName="Guest";
  			return $custName;
    	}
    	//the session is valid and user is logged in
    	else  
    	{ 
    		return $custName; 
    	}
    }
    else
  	{
    	
    	$custName="Guest";
  		return $custName;
  	}
    
  }
  else
  {
 
   	$custName="Guest";
  	return $custName;
  }
  exit(); // Quit the script.
}
 
//---------------------------------------------------------------------
//---------------------------------------------------------------------

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:

sorry I had a slight typo in there - CU.php should only have one session_start();!

CU.php should look like:

<?php
 
session_set_cookie_params(0, '.mydomain.com');
session_start();

                                              

1:
2:
3:
4:

Hi hernst42

Sorry there was a slight typo - so it does actually look like that. The problem is that when I try and add the code the suggested code the $_SESSION['user_id'] doesn't seem to be staying anymore...I remove the the line of code with session_set_cookie_params in it  and it starts working...

If you add/change that line you will need to clear all cookies to make it work correctly, else the old session-cookie and new session-cookie overlap, which leads to unpredictable results.

Hi Hernst42

I've cleared all the cookies, and im afraid the result is still the same, the following are the two cookies that were generated:

secure.mydomain.com  PHPSESSID   .mydomain.com ce4032423432699fe24a098
www.mydomain.com     PHPSESSID   .mydomain.com 432d2434f43242a4324fr324

I added a var_dump to see what was happening and the session data seems to get wiped. If I remove the set_session_cookie_params the session data is preserved.

To clean things up a bit and and to make it easier I also removed the following with the sscp in place, but to no avail :(:

 if (!isset($_SESSION['agent']) OR ($_SESSION['agent'] != md5($_SERVER['HTTP_USER_AGENT'])) ) 
  {
  $ok=false;
  }

                                              

1:
2:
3:
4:

The values for the cookies PHPSESSID should be the same for both servers, if not the session data is not shared.

Don't know why the session is not found correctly. Are you sure that are no cookies for www.mydomain.com which are valid for www.mydomain.com  and not .mydomain.com. Do you have an URL where this can be tested with cookie_params. I want to check it by my own.

I am pretty sure there are no cookies, I deleted them all, have tried it on multiple browsers, and restarted the computer too. I only have the url that will eventually be the live url. Is there some way I can get it to you without having to broadcast the url to the world...

Thanks again for your help on this...

@coincidence: Do you have Firefox?  If so, you can go Tools => Options => Privacy => Show Cookies and find what's in the cookies for your domain.  HTH, ~Ray

Hi Ray -

yeah thats where I got the info I mentioned in a couple of posts above...

Possibly your secure and unsecure servers are not on the same machine?

http://markmail.org/message/agm4gehiawycdnpo

Don't know if that's the case, but if they are on different machines, it might explain different SESSID.

Grrr.....I wish I had *@£&!&$ checked that before.

I just did a ping of the two sites and the IP addresses are different. It is a shared ssl so I guess that makes sense but If I want to continue using this shared SSL how do I get round it without doing everything in https?

Sorry, I don't know how to get around it - that's too deep into the internals of PHP for me!.  

I would probably opt for (1) using my own cookie and/or (2) going 100% HTTPS. I don't know another way of getting around this with just PHP commands.  I realize that HTTPS is somewhat slower than clear text, but if you are not sending a lot of images and graphics it may be OK, performance-wise.

The overall workflow I follow is this:

1. get cookie from browser
2. if cookie, get state information from data base
 -- do stuff --
3. put state information into data base
4. put cookie on browser

You can put anything you want into "state information"... and you can easily set a cookie that is both HTTP and HTTPS, so you are not dealing with a lot of variables and you can put much of this logic into the header of each page or into a single function call.

Best of luck, ~!Ray

I think that the code I have is probably adaptable to what you are suggesting.

Could I keep the session variables for the most part but then put the session id in in a cookie (available on both servers) and also put it in the database with the other session data?

 I am not very adept at cookies could you suggest how I might adapt the code, ie - the function require_authentication_frontend and the code above that where I put the session data into the database at login?

I am still now clear on how I would make the cookie available on both servers?

Also what are the implications of doing this in terms of security? Would it make it easier to hijack a session now that I have a cookie?

Thanks.

im afraid I am still having a few problems. I have added the code you suggested. I have removed the cFlag if else statement but kept the cookie expires part.

 I have removed all the cookies in the browser.

I put the suggested code into my login code and the cookie appears in secure domain cookies. The way I can tell this is working is that I added this code to CP.php

  if(isset($_COOKIE['mycookiename'])) { echo "your cookie was found..."; }

This works in the secure area, but it doesn't work in the non-secure area. It appears to be the same problem I had with the code suggested by hernst42.

As I mentioned above, two different servers are being used here by the host. The IP addresses are DIFFERENT. If that makes any difference to your suggested solution...

Thanks again...

Please send me a link.  You can post it like this if you want to obscure from Google: I can figure it out.  Also, please post the code you're using.  I'll have one more look. ~Ray

w mydomain c  -- or --  w mydomain n

Hi Ray_Passeur

Thanks for your help. I have managed to fix the problem. I should have noticed this... since the cookies are originally created in the secure area, instead of the line:

$cookie_domain  = str_replace('www', '', strtolower($_SERVER["HTTP_HOST"])); // STARTS WITH DOT

I should have changed it to:

$cookie_domain  = str_replace('secure', '', strtolower($_SERVER["HTTP_HOST"])); // STARTS WITH DOT

Once I did this, the cookies became visible in both areas of the domain.