SSL/Session question

[Peter Rooney]

Hi,

Just a quick question, I have a login page that sits on a non secure
page, if the users login details are correct then a session is created
and they are passed to another non secure page, once this page is
displayed all links go to secure pages using SSL.

What seems to be happening is that when a link to a secure page is
followed the session is lost and the user is re-directed to the login
page, is something in the passing between secure and non secure pages
that is destroying the session? If I enter the front of the site using
the SSL everything works fine which is the reason for my question.

Thanks

Peter

 

[Ray at]

This is true that session variables won't be carried between http and https
pages.

Shouldn't the user be logging in over ssl anyway though? If you aren't
encrypting the login, what's the point? Even if the login page is not
https, at least have the form submit to https.

Ray at work

 

[Peter Rooney]

Hi Ray,

Thanks for coming back to me, yes you are correct I have since moved the
login page over to the ssl, I figured that was the reason but just for
my own learning process I just wondered if transfering between http and
https would destroy a session.

Many thanks again for you reply

Peter