How can I transfer session information between the non-secure and secure pages? As far as I can tell it is not doable with cookies as they are inherently tied to the domain. That means I have to use the URL, or a hidden form field. Anyone disagree? Am I missing some nice feature that will solve this?
If not, the way I thought of to do this and not make it open to session hijack attacks is to save the session key in my database, create a short random temporary key to pass in the URL, and timestamp the database entry that links those fields. Then the target page reads this, checks the timestamp, if it's OK (say within 30 seconds) sets the session ID from the database, and redirects to itself but without the passed temporary key.
Any thoughts?
Thanks,
--
Tom
I think what you are suggesting is fine. Just to throw out another idea, what you might do instead is store all of the actual session information in the database. You can then tell the other server(s) which row contains the session information for this user and grab the session that way.
The php function to do this is session_set_save_handler()
http://www.php.net/manual/en/function.session-set-save-handler.php
The PHP documentation has info on how to do this, I also remember seeing a code example for this at Zend's site.