Session variables & cookies disappearing in IE when going from https to http page

Question

On an Apache server, I have set of Profile pages within a folder protected by htaccess (/main/profile). After a user updates their profile, I want to set a $_SESSION['timelineuser']= or a session cookie for use back in the main folder of the site (/main/) which is unsecure.

On the unsecure page I want to check to see if $_SESSION['timelineuser'] exists. Works fine in Firefox, Chrome, etc. In IE8, the behavior is bizarre - the $_SESSION (and cookie in my other tests) doesn't show up when you click on the http:// link back to the main page after updating your profile. However, if you refresh the browser it does show up.

It has something to do with how I link from the secure page. If I have an href="/main/index.html" it works but throws security warnings. If I have an href="http://www.foo.com/main/index.html" (where I want it to go) in IE there ia a brief blank screen before the main page loads.

Something to do with going from https to http?

Answer 1

I think this is a page caching issue. Try adding the following to your unsecure page see if it helps:

<meta http-equiv="cache-control" content="no-cache">
<meta http-equiv="expires" content="0">
<meta http-equiv="pragma" content="no-cache">

One confusing point about your post (perhaps I'm misreading it). It seems you're redirecting the user back to an .html page and trying to check the session there. I assume you mean a .php page.

Answer 2

OK, I figured it out and it was something ridiculous. The links I had going from the https page back to http didn't have www in them. When I changed the links from http://foo.com to http://www.foo.com, the SESSION variable was passed properly in Internet Explorer.

Sheesh. Thanks for the suggestions. Hopefully this will help someone else who runs into this same problem

One further note - the security settings for my organization's install of IE8 are pretty stringent and have caused strange behavior in the past, so it's possible that this wouldn't happen in all instances of IE8.