session question with virtual host

Question

hello, everyone! i have a question about sessions hopefully someone can help me with. I have a apache test server set up that uses virtual hosts for http and https. I put the following files in my https and it works:

mytest.php:

// this starts the session
session_start();
// this sets variables in the session
$_SESSION['color']='red';
$_SESSION['size'] ='small';
$_SESSION['shape']='round';
echo "Done";

mytest2.php:

// this starts the session 
session_start(); 
// echo variable from the session, we set this on our other page 
echo "Our color value is ".$_SESSION['color']; 
echo "Our size value is ".$_SESSION['size']; 
echo "Our shape value is ".$_SESSION['shape']; 

But it doesn't work when I view the copy in http.

phpinfo() in both are the same:

session
Session Support  enabled
Registered save handlers  files user sqlite
Registered serializer handlers  php php_binary wddx

Directive Local Value Master Value
session.auto_start Off Off
session.bug_compat_42 On On
session.bug_compat_warn On On
session.cache_expire 180 180
session.cache_limiter nocache nocache
session.cookie_domain no value no value
session.cookie_httponly Off Off
session.cookie_lifetime 0 0
session.cookie_path / /
session.cookie_secure On On
session.entropy_file no value no value
session.entropy_length 0 0
session.gc_divisor 100 100
session.gc_maxlifetime 1440 1440
session.gc_probability 1 1
session.hash_bits_per_character 4 4
session.hash_function 0 0
session.name PHPSESSID PHPSESSID
session.referer_check no value no value
session.save_handler files files
session.save_path /tmp /tmp
session.serialize_handler php php
session.use_cookies On On
session.use_only_cookies Off Off
session.use_trans_sid 0 1

Answer 1

The problem is this:

session.cookie_secure On On

If the the cookie is session cookie secure, it'll only be sent via https by the client.

Change that ini setting or call session_set_cookie_params prior to session_start and specify there you don't want a secure cookie, e.g.:

session_set_cookie_params(0, '/', "example.com", false);

Answer 2

As it has already been said, it's probably because you're using secure cookies.

Note that, if you're not using secure cookies, you need to be careful in the logic of your application to enforce its security. It's OK to go from HTTPS to HTTP, but then, you should discard the HTTPS session. Otherwise, an attacker could get the cookie from the HTTP connection and use it over the HTTPS connection, pretending to be authenticated as the legitimate user.