https post to http

[CassidyHunt]

I have a shopping cart that I have post the items from one page to the next. When the user goes to the secured portion of the site and then returns to another portion of the site without completing the transaction I can not get the data to post.

The only difference I can see between the two is it works fine posting from an http page to an https page but not the other way.

Is there anyway around this?

 

[TonyRosen]

I'm guessing you are attempting to pass those POST variables from the HTTPS side to the HTTP side ... and, it isn't going to work like that.

Why are you having them go back and forth between HTTPS and HTTP?

 

[CassidyHunt]

I have a shopping cart that if during the checkout process they want to go back to the catalog I want to carry the items with me.

 

[CassidyHunt]

I thought I should add how the cart works. Currently I have it using a hidden form value on the page and a script that adds and onclick event to all links on the page. That script sets the form to post to the destination of the link. When they hit checkout then I take them to a secured portion of the site and process the checkout. Problem comes when they click checkout then go back to another page on the site. I lose the cart because I can not get the post.

Thanks

Cassidy

 

[TonyRosen]

If the users have not input any personal information yet, why not just carry it over in a cookie or two?

 

[CassidyHunt]

I was told to not use cookies if at all possible. Most of the clients accessing the site will not allow cookies.

That was the reason for changing to a form post method and having to write the script to change all links on the page to post a form.

 

[TonyRosen]

There's always the session variable(s). You have to store the responses somewhere. Your choices are:

1) Cookies (as you stated)

2) Session Variables (you're switching between the two "sides")

3) Database (You'd be banking that people actually somehow finish the transaction)

4) QueryString (100% not secure)

At some point, you're going to have to pick a poison.

 

[TonyRosen]

Oh, and if you select sessions, you'll want to read:

http://www.tek-tips.com/faqs.cfm?fid=2037

(which is the second or third time that that FAQ has popped up today...odd)

 

[CassidyHunt]

I tried session variables and they work as long as I don't switch between http and https...I will read the faq and let you know what I come up with.

 

[TonyRosen]

That FAQ covers the handling of session variables in an environment similar to what you are using ... sort of.