RE: [PHP] secure site question

If you set your session domain (for the cookie) to ".xxx.com" any 3rd level domain on xxx.com will be able to read it, so it will be visible to both www.xxx.com and secure.xxx.com. http://xxx.com will not be able to read it, however. If the directory where your sessions are stored is readable by both www and secure, you should be good to go (if using native session handlers). Just passing the session ID as part of the URL seems sort of insecure to me, but it's really a 1/2 dozen of 1, 6 of the other situation. > -----Original Message----- > From: Tom Rogers [mailto:trogers@kwikin.com] > Sent: Wednesday, April 23, 2003 7:37 AM > To: Michael Lewis > Cc: php-general@lists.php.net > Subject: Re: [PHP] secure site question > > > Hi, > > Thursday, April 24, 2003, 12:26:04 AM, you wrote: > ML> I'm having a problem and I'm not quite sure what the best way > to solve it is > ML> so I'm looking for some guidance. I have an e/COMMERCE site that uses > ML> sessions named www.xxx.com. The final step (payment) involves > getting credit > ML> card information so I bop over to https://secure.xxx.com > which serves up the > ML> page correctly. The problem is that it knows nothing about my previous > ML> session so the cart and login information is no longer there. > How can I let > ML> the secure page know what's going on with the order? I'm > trying to avoid a > ML> kludge here so I'm hoping someone has already faced this problem. > > ML> Thanks > > > You also have to pass the sessionid and use that to restart the > session. You can do that in the url > https://secure.xxx.com?sess=xxxxxxxx > > Then > > if(isset($_GET['sess'])){ > session_id($_GET['sess']); > } > session_start(); > -- > regards, > Tom > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php >