Loosing cookie when swich from http to https

Question

I have the option in my site to change language.

When user change language ,its saved in cookie, so the other pages know which language to display!

Some of the pages are in https. And in these pages I don't get the selected language.

Is there any way to use the same cookie for http and https?

See http://stackoverflow.com/questions/5843305/switching-between-http-and-https-pages-with-secure-session-cookie — Paul Zahra, Jan 14 '13 at 09:27
Please have a look at this question http://stackoverflow.com/q/2321224/1916110 - it can explain. — Tom, Jan 14 '13 at 09:29
Offtopic: no solution to go to all HTTPS? http://www.imperialviolet.org/2010/06/25/overclocking-ssl.html — RvdK, Jan 14 '13 at 09:39

score 4 · Answer 1 · edited May 23 '17 at 12:23

4

You could try setting your cookie to secure = false

edited May 23 '17 at 12:23

Community

answered Jan 14 '13 at 09:29

Ant

score 3 · Accepted Answer · edited Sep 23 '15 at 17:34

3

No, there isn't. The cookies are local to the domain, and the http and https pages are considered to be in different domains.

The https pages are encrypted, so sending the same cookies for a http request would leak that information, and compromise the encryption.

edited Sep 23 '15 at 17:34

Funk Forty Niner

answered Jan 14 '13 at 09:29

Guffa

From reading and my own testing I believe this is incorrect. Unless specified as secure, a cookie can be read over both http and https on the same domain. – rrrr-o Feb 14 '14 at 14:37
@rrrr: Cookies are subject to the same-origin policy (http://en.wikipedia.org/wiki/HTTP_cookie#Secure_cookie), and the scheme (http: / https:) is part of what determines the origin (http://en.wikipedia.org/wiki/Same-origin_policy). – Guffa Feb 14 '14 at 16:54

2 Answers2