# SSL Certificate and cookies

**URL:** <https://www.ruby-forum.com/t/ssl-certificate-and-cookies/86431>\
**Category:** Rails\
**Created:** [February 22, 2007, 6:36am UTC](https://www.ruby-forum.com/t/ssl-certificate-and-cookies/86431 "2007-02-22T06:36:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [February 22, 2007, 6:36am UTC](https://www.ruby-forum.com/t/ssl-certificate-and-cookies/86431/1 "2007-02-22T06:36:36Z")

</div>

Hi there

I have an SSL Certificate issued for [mydomain.com](http://mydomain.com) (not [www.mydomain.com](http://www.mydomain.com))

I’m stuck with the scenario where a user visits [www.mydomain.com](http://www.mydomain.com) and  
logs in so that a cookie is set by [www.mydomain.com](http://www.mydomain.com)

Then they go to checkout and are redirected to [https://mydomain.com](https://mydomain.com) -  
now they are not seen as logged in as the cookie was issued by  
[www.mydomain.com](http://www.mydomain.com)  
not [mydomain.com](http://mydomain.com) and so are then getting redirected to the login page.

I’m using acts\_as\_authenticated and all is fine except for this issue.  
Any clues would be appreciated.

Richard

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [February 22, 2007, 8:03am UTC](https://www.ruby-forum.com/t/ssl-certificate-and-cookies/86431/2 "2007-02-22T08:03:41Z")

</div>

If it were me, I’d force my web server or proxy to redirect all

> **[Website Domain Names, Online Stores & Hosting - Domain.com](https://www.domain.com)**
>
> Finding the perfect website domain is as easy as 1-2-3. Buy a domain name, build and host a website, and enjoy our professional online marketing tools.

requests to [domain.com](http://domain.com). It’s fairly easy.

For instance, this is how you do it using nginx:

# redirect www to non-www (for cookies)

if ($host != ‘[domain.com](http://domain.com)’ ) {  
rewrite ^/(.\*)$ [http://domain.com/$1](http://domain.com/$1) permanent;  
}

Of course, you’d want to add logic so that you’re not redirecting your  
SSL traffic to a non-SSL host … but you get the drift.

Hope that helps…

-Chris

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [February 22, 2007, 10:02am UTC](https://www.ruby-forum.com/t/ssl-certificate-and-cookies/86431/3 "2007-02-22T10:02:54Z")

</div>

removed\_email\_address@domain.invalid wrote:

> I have an SSL Certificate issued for [mydomain.com](http://mydomain.com) (not [www.mydomain.com](http://www.mydomain.com))
> 
> I’m stuck with the scenario where a user visits [www.mydomain.com](http://www.mydomain.com) and  
> logs in so that a cookie is set by [www.mydomain.com](http://www.mydomain.com)
> 
> Then they go to checkout and are redirected to [https://mydomain.com](https://mydomain.com) -  
> now they are not seen as logged in as the cookie was issued by [www.mydomain.com](http://www.mydomain.com)  
> not [mydomain.com](http://mydomain.com) and so are then getting redirected to the login page.

You can set the domain for your session cookie to be “.mydomain.com”,  
thus  
regardless of the subdomain session state will be kept. A simple way  
would  
be to add this line to your production.rb:

> ActionController::CgiRequest::DEFAULT\_SESSION\_OPTIONS.update(:session\_domain =\> “.mydomain.com”)

## Zsombor

Company - [http://primalgrasp.com](http://primalgrasp.com)  
Thoughts - [http://deezsombor.blogspot.com](http://deezsombor.blogspot.com)