session ID different b/w 2 virt servers

[thedaver]

In hindsight this is obvious, but now I'm in a pinch...

I use

https://secure.domain.com/login.php

to process and store some really fun stuff into a session data set stored in MySql (instead of /tmp). The client browser gets a session id for that login on the secured server of (eg.) '1234567890A'. All session functions work fine in test on this host.

My app logic is to redirect authenticated client logins to

http://www.domain.com/welcome.php.

However, when they arrive at that "other" location, their session ID is different (eg.) 'A0987644444'. Because the session is different, none of my stored session data from the "other" host is available to the new session.

Surely it's really common to securely authenticate and then hand off the session to a non-secured host (and back again?).

What can I do?! Hopefully I can avoid reliance on cookies.
THANKS!

 

[AnakinPt]

This is hipotetical. I need to do that too. I have not tried, but what you can try is to set a cookie in the first page with the domain being the other one, and when you reach the second page you red the cookie. Hippotetical can work. If works, let me know. I'monly going to try this tomorrow morning. Anikin
Hugo Alexandre Dias
Web-Programmer
anikin_jedi@hotmail.com

 

[thedaver]

Anikin, great idea. I'm also going to try another method of actually embedding the SID into a POST/GET just to see what happens. This isn't really my favorite approach since it messes up security (possibly) and search engine friendliness (definitely).

Let's "talk" tomorrow.