0

I manage a website(single page application) with custom session code managed by a team to which i do not have access. The application is custom built using appweb and is not like any other publicly hosted web sites. This app has been served both in http and https. In that after logging in http if the user logs into https the secure attribute is not set despite the following code. 

$https = $_SERVER['SERVER_PROTOCOL'] == 'https' ? 1 : 0;
ini_set("session.cookie_secure", $https);
//or
session_set_cookie_params(0, '/', null, $https, 1);

So, i overwrote the session cookie like in the following with the above code. It worked.

$sessname = session_name();
setcookie($sessname, $_COOKIE[$sessname], 0, '/', null, $https, 1);

The anomaly is when opening both http and https in two tabs which causes either of the session invalid cause of custom code. Though it is a negative scenario this may cause confusion to the user if he do like the above.

I know there are other options to circumvent this and i had been using those like redirect. Yet i wanted to check whether my alternate holds good.

Now what i had been thinking as an alternate is the following.

$https = $_SERVER['SERVER_PROTOCOL'] == 'https' ? 1 : 0;
$sessname = session_name();
$domain = $_SERVER['SERVER_PROTOCOL'].'.'.$_SERVER['REMOTE_ADDR'];
setcookie($sessname, $_COOKIE[$sessname], 0, '/', $domain, $https, 1);

Here i have set a different domain name for http and https for the same session id. when logged in http the php session id will have domain as http.10.10.10.1 and when logged in https the php session id will have the domain set to https.10.10.10.1. It is working.

Is it a right way. Will there be any side effects?

Jayapal Chandran
  • 10,600
  • 14
  • 66
  • 91

1 Answers1

0

Why don't you just redirect every http request to https? Using PHP or htaccess: 

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

Otherwise, I think you might want to look at those similar questions:
Session lost when switching from HTTP to HTTPS in PHP
Switching between HTTP and HTTPS pages with secure session-cookie
Cookie across HTTP and HTTPS in PHP

Community
  • 1
  • 1
Kev
  • 454
  • 6
  • 14
  • If that is possible I wouldn't have asked this question at the first place. forget it. Sorry that i did not mention that in the question. so sad. now it is there. – Jayapal Chandran Jan 28 '15 at 19:52
  • Did you take a look at the similar questions? Does it help in any way? – Kev Jan 28 '15 at 19:57
  • YOU DID NOT ANSWER MY QUESTION. The third one is not applicable here. The code base is different so cannot apply first two ones. How about my alternate? – Jayapal Chandran Jan 28 '15 at 20:03