Session Loss With Scheme Change

I just ran into an interesting problem; maybe it’s well-known and I just couldn’t find the solution.

A user is browsing through the site, http ://www.thesite.com, and all is well. He goes to the site’s online shop. He loads a few items into his cart, which is stored in the SESSION at this point. Then he goes to the "checkout", which is https ://www.thesite.com/checkout.html. The session values are lost, and now there are two session cookies in his browser cache, one with the original session_id, the other for the new HTTPS session which is empty.

An empty cart automatically redirects him back to the main shop page, with an empty cart. But now he’s still in HTTPS, so anything he does now gets carried across to the checkout page OK.

I hacked a workaround, getting the session_id and passing it in the GET to the plugin that loads the SESSION and doing some checks and killing a new session and restarting the old one if necessary. But I was wondering if there is a better way, or if this should be happening, or if it would be better to somehow have MODx know not to start a new session under these circumstances, or if that’s even possible. Or something.

I think that’s the way that Sessions are supposed to work Susan. https and http are functionally different servers as far as the browser knows.

I agree with Ryan, this session-handling behaviour is by design.

The only other way I can think of is to use the database to store the shopping cart information and then reload the information back into the session when switching from one scheme to the next. (Not sure if this has any distinct advantages to how you are doing it already though)

garryn is exactly right -- this is by design. You should not store anything on the client side except a session ID. Anything else stored there (items, prices, etc) are subject to being manipulated by a malicious user.

My suggestion would be to just cookie the client with an ID, store all the other session info in the DB (keyed to the ID), and retrieve it as necessary. This allows your site to only work across http/https servers, but also scales well for when you want to spread your store across multiple servers for load-balancing reasons.