My purpose is to have a fully SSL site. The web host gave this format of URL for my shared server SSL: https://hostaddress.net/example/ where www.example.com is the domain name.

I conducted the following tests to try to isolate the issue, but failed to find an answer. The script outputs the session_id and another session variable in order to test the session. The site url goes to the index page which then immediately directs to the first form page. The first form script submits input to itself then urls to a second page, where the session variables are output in order to test the session.

Before every test I delete the sessions at the server, and also delete the cookies, browsing and download history, and cache on the client (firefox).

Test 1 - non-SSL - the base http script that works:

htaccess script is blank; $params secure = false.

Result: An unchanging cookie is observed in Firebug (security = blank). The input plus submit outputs the form input value, the session id and the session variable value on the second page. All correct.

Test 2 - SSL:

htaccess (below, as supplied by the web host); $params secure = true.

RewriteEngine On

RewriteCond %{HTTP_HOST} ^(.*)example.com [NC]

RewriteCond %{SERVER_PORT} 80

RewriteRule ^(.*)$ https://hostaddress.net/example/$1 [R,L]

Result: The SSL URL shows in the address bar as expected. The posted value reaches the first page again as expected, and the posted value is assigned as a session variable to be picked up on the second page. It fails to do this. A new session_id is shown on the second page yet doesn't show as a cookie on firebug (as it did on Test 1).

Question: How do I get the session data that is saved on the server to show on the client, and get the cookie saved on the client, while using $params secure=true and the SSL URL in htaccess?

If the scripts and outputs would help I have them available.


By trial and error I found the answer:

It seems that when SSL is used (test 2), setcookie is required as follows:

setcookie('sessionname', session_id(), time()+whatever, '/', 'theSSLhostaddress', true, true or false);

Also, the htaccess works in test 2.

The non-SSL script (test 1) did not require setcookie!

Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.