Cookie Problem

Here's a glitch I'm not totally sure how to deal with. A site I am building will use a range of different domains for http, all accessing the same site -- there will be dozens, perhaps hundreds, and they are totally different -- not just abc.mydomain.com and xyz.mydomain.com, but abc.domain1.com and def.domain2.net, etc. This setup is necessary due to the purpose and configuration of the site, how it is accessed, and the business requirements of the client. Portions of the site require https, which requires a single domain since the server cert is tied to the domain. So all non-secure pages go through their respective domains and all secure pages go via the single secure domain. PHP is configured to use only cookies for session data. How can I transfer session information between the non-secure and secure pages? As far as I can tell it is not doable with cookies as they are inherently tied to the domain. That means I have to use the URL, or a hidden form field. Anyone disagree? Am I missing some nice feature that will solve this? If not, the way I thought of to do this and not make it open to session hijack attacks is to save the session key in my database, create a short random temporary key to pass in the URL, and timestamp the database entry that links those fields. Then the target page reads this, checks the timestamp, if it's OK (say within 30 seconds) sets the session ID from the database, and redirects to itself but without the passed temporary key. Any thoughts? Thanks, -- Tom