# Sessions and HTTPS

**URL:** <https://www.ruby-forum.com/t/sessions-and-https/72678>\
**Category:** Rails\
**Created:** [October 18, 2006, 10:40am UTC](https://www.ruby-forum.com/t/sessions-and-https/72678 "2006-10-18T10:40:26Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gareth\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/b9bd4f/32.png) [@Gareth\_A](https://www.ruby-forum.com/u/Gareth_A)\
**Post date:** [October 18, 2006, 10:40am UTC](https://www.ruby-forum.com/t/sessions-and-https/72678/1 "2006-10-18T10:40:26Z")

</div>

Hi all,

I’m having a problem and I don’t even know it it _is_ fixable, let along  
how to  
fix it.

I have a section of my site which redirects to an HTTPS connection to a  
different subdomain, so that users can safely make a payment. The  
redirection  
works fine, and the payment process runs as expected, but when the user  
returns  
to an http:// connection they are logged out. It seems that the session  
cookie  
isn’t being sent.

The situation is like this:

protocol: HTTP -\> HTTPS -\> HTTP  
session: OLD -\> OLD -\> NEW

Now, I have my cookies set up to persist across subdomains, and that  
works  
across the rest of the site, however as I say on returning from an https  
connection, no cookie is sent by the browser and therefore a new session  
is  
created.

Is there some way I can set up cookies to persist across HTTPS _and  
back_?  
What’s surprising is that there’s no problem with the switch _TO_ HTTPS

Thanks,  
Gareth

---

<div class="post-metadata">

**Author:** ![Gareth\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/b9bd4f/32.png) [@Gareth\_A](https://www.ruby-forum.com/u/Gareth_A)\
**Post date:** [October 18, 2006, 10:44am UTC](https://www.ruby-forum.com/t/sessions-and-https/72678/2 "2006-10-18T10:44:00Z")

</div>

Gareth A. wrote:

> isn’t being sent.
> 
> Is there some way I can set up cookies to persist across HTTPS _and back_?  
> What’s surprising is that there’s no problem with the switch _TO_ HTTPS

I have a similar setup but am not seeing this problem. How are you  
redirecting  
from HTTPS to HTTP? Are you forcing HTTP using mod\_rewrite?

Long

---

<div class="post-metadata">

**Author:** ![Gareth\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/b9bd4f/32.png) [@Gareth\_A](https://www.ruby-forum.com/u/Gareth_A)\
**Post date:** [October 18, 2006, 10:44am UTC](https://www.ruby-forum.com/t/sessions-and-https/72678/3 "2006-10-18T10:44:03Z")

</div>

Hi Gareth -

Try this:  
ActionController::CgiRequest::DEFAULT\_SESSION\_OPTIONS.update(  
:session\_domain =\> ‘.example.com’)

It will maintain your session across anything with ‘.example.com’ .

Cheers  
Starr

---

<div class="post-metadata">

**Author:** ![Gareth\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/b9bd4f/32.png) [@Gareth\_A](https://www.ruby-forum.com/u/Gareth_A)\
**Post date:** [October 18, 2006, 10:44am UTC](https://www.ruby-forum.com/t/sessions-and-https/72678/4 "2006-10-18T10:44:04Z")

</div>

Starr wrote:

> Hi Gareth -
> 
> Try this:  
> ActionController::CgiRequest::DEFAULT\_SESSION\_OPTIONS.update(  
> :session\_domain =\> ‘.example.com’)
> 
> It will maintain your session across anything with ‘.example.com’ .

I will add that I’d place the code-snippet in environment.rb (there may  
be other suitable  
locations) and only enable for ‘production’. If you enable in  
development (WEBrick)  
you will quickly find sessions unusable.

Long

---

<div class="post-metadata">

**Author:** ![Gareth\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/b9bd4f/32.png) [@Gareth\_A](https://www.ruby-forum.com/u/Gareth_A)\
**Post date:** [October 18, 2006, 10:44am UTC](https://www.ruby-forum.com/t/sessions-and-https/72678/5 "2006-10-18T10:44:13Z")

</div>

Starr wrote:

> That’s a good heads up, Long. - Thanks

You’re welcome. The issue might come up later so I’d though I should  
mention it.

Cheers,

Long

---

<div class="post-metadata">

**Author:** ![Gareth\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/b9bd4f/32.png) [@Gareth\_A](https://www.ruby-forum.com/u/Gareth_A)\
**Post date:** [October 29, 2006, 3:28pm UTC](https://www.ruby-forum.com/t/sessions-and-https/72678/6 "2006-10-29T15:28:31Z")

</div>

One more thing - looking at the rails wikki, it seems as if some people  
can’t get it to work without omitting the ‘.’ from the domain name.

---

<div class="post-metadata">

**Author:** ![Gareth\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/b9bd4f/32.png) [@Gareth\_A](https://www.ruby-forum.com/u/Gareth_A)\
**Post date:** [October 18, 2006, 10:44am UTC](https://www.ruby-forum.com/t/sessions-and-https/72678/7 "2006-10-18T10:44:13Z")

</div>

That’s a good heads up, Long. - Thanks

Starr