In a situation where a user goes to a HTTPS page to login securly then posts to a script that processes the login. Then the user is logged in but the remaining pages are nolonger using SSL. How would this be done if the SSL server would have its own session, and the HTTP server would have its own session?
I was advised to pass the SESSION ID as a GET variable... however that itself is insecure... any ideas?
Thanks,
Ryan
What I do here is however you get from https to http, I pass along the sessionid via either a hidden field or query string variable. Because you're going FROM secure to non-secure, I don't see how security is an issue as long as the login doesn't involve sensitive information. If it does, apply the same encrypting/decrypting techniques - encrypt it before storing it in a hidden field/qstring, decrypt it before evaluating it in the read/parse.
the OP didn't mention anything about different domains, just different servers. I assumed the servers were all using the same domain but that could be a wrong assumption. In which case your suggestion would have to be used.
Also, no matter what the actual login information, you have to treat a login as confidential and must be secure because if compromised it can lead to personal information being divulged.
I suppose my use of the sessionid is different, then. No one should be able to log in or hijack a login based on the sessionid. To do that you'd need both the sessionid AND the login name/pass, and neither can be accessed from the other.
rocknbil rests, sorry for the wasted server space.
