Re: PEAR::Auth - one Auth on multiple domains

I am not a security specialist, but I think you can do this : In the http domain, record the session ID to your database (in the corresponding user row) When switching to the https domain, transmit the session ID to the secure page via GET In the https domain, check the session ID recorded in the database to retreive the user ID Back to the http domain... Well the session should still work. Otherwise you can send the session ID again via GET and retreive the session using the value recorded in the database. I would be interested to know other solutions, and if mine could be a security issue, because I think one of these days I'll have to do this too. ++ Le 10 mars 06 à 04:09, sam a écrit :

Hi, The situation: a user logs in on an unsecure site to shop and when they have ordered some products and check out they go to a secure server (with a different domain) to enter payment details. The problem: As soon as the user goes to the new server the Auth session is lost. Can someone suggest a solution? thanks Sam --PEAR General Mailing List (http://pear.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php