https Domain != http Domain

[John Steed]

So, da bin ich wieder! Sorry, war unterwegs

Die Sessionid (XTCsid) müsste doch leicht beim Übergang auf https weitergegeben werden können.........

Nochmal: An den Proxy Deines Providers und an dessen Session-ID kommst Du nicht ran!

Wenn Du von deinserver.de zu irgendeinsslserver.de/deinserver wechselst, *muss* IMHO die Session-ID per GET übertragen werden, damit der Shop sie dann weiterverwenden kann. Das hat mit den Cookies des Proxys eigentlich gar nix zu tun, das regelt der Shop selbst - eigentlich...

Hier mal was aus dem Supportforum von osC:

For example, the force cookie usage implementation will work for the following servers:

http://www.domain-one.com
https://www.domain-one.com, or https://ssl.domain-one.com

but not for the following servers:

http://www.domain-one.com
https://ssl.hosting_provider.com/domain-one/

The ssl.hosting_provider.com example is using a shared SSL certificate used for secure transactions. This can easily be fixed to work with the force cookie usage implementation by purchasing and installing a dedicated SSL certificate for the domain-one.com domain.

It is possible to bypass the cookie check by appending the session ID to the url when the client moves from HTTP to HTTPS state, or from HTTPS to HTTP state; however the main goal this implementation is trying to achieve is to not place the session ID on the url at all which would occur if the clients browser had cookies disabled.

A simple case of this implementation failing where different HTTP and HTTPS domains are used is when the client first visits the online store (cookie is set for HTTP domain) and clicks on the secure Login link (cookie is set for the HTTPS domain).

As cookies cannot be read on the same request made when they are set for the first time, the Login page cannot access the HTTPS domain cookie as it has just been set, and it can also not read the HTTP domain cookie as it is another domain.

Den ganzen Thread findest Du, wenn Du bei Gurgel folgendes suchst:
"SSL und Force Cookie Problem, SID-Übergabe beim Log-IN"

Cheers,
IaN