Re: Cookie Problem

* Thus wrote trlists@clayst.com (trlists@clayst.com): > > > How can I transfer session information between the non-secure and > secure pages? As far as I can tell it is not doable with cookies as > they are inherently tied to the domain. That means I have to use the > URL, or a hidden form field. Anyone disagree? Am I missing some nice > feature that will solve this? Unfortantly this really has to be done manually, there really isn't any built in system that securely handles this situation. > If not, the way I thought of to do this and not make it open to session > hijack attacks is to save the session key in my database, create a > short random temporary key to pass in the URL, and timestamp the > database entry that links those fields. Then the target page reads > this, checks the timestamp, if it's OK (say within 30 seconds) sets the > session ID from the database, and redirects to itself but without the > passed temporary key. This is very close on how I would handle it. The biggest difference is I would make the random key as long as possible (md5 or sha1) hash. source.php: $key = sha1(uniqid(rand(), true)); $_SESSION[['key'] = $key; $_SESSION[['timestamp'] = time(); target.php: compare $key passed in url (or post) with the session data from the database. If you desire for expiration, compare that also. If you want to get real fancy, you could also use something like PGP to encrypt the $key from the source with its private key and then have the target.php decrypt and validate that this value really came from source.php. HTH, Curt -- "I used to think I was indecisive, but now I'm not so sure."