iis 7 - Classic ASP session weirdness between HTTP and HTTPS -
I have an ecommerce website written in classic ASP that uses session to store shopping cart contents and other things Does.
Items are added to the cart in HTTP and when the user checks that they are taken over HTTPS. There is no problem at this point, the HTTPS checkout page receives the session value correctly.
The problem is that if they click to return to the shopping cart (HTTP) session is lost.
If they add items to the cart, they appear correctly in shopping cart (http).
But when they return again checkout (HTTPS) items that were returned before the original session disappeared.
If they go back to the HTTP shopping cart page then there are different items.
So for the first time in the summary, when I transmit HTTPS to HTTPS, it works fine, but after that it is like two independent sessions.
The domain name is exactly the same for HTTP and HTTPS.
The website is hosted in a shared hosting environment, it is a 64-bit server on IIS7.
I have tried integrated and classic managed pipeline mode.
In web.config, I have established the same session for HTTP and HTTPS, like this:
& Lt; / ASP & gt; & Lt; /system.webServer> Any ideas how can I fix this problem?
Update: By looking at the HTTP header it seems that when it goes to HTTPS, another ASP session cookie is created. Not sure why he clears the first one when the HTTP is back only to the original cookie, but there is no value in the session now, so possibly a new cookie has been assigned and the previous one is no longer valid.
applicationHost.config No web.config updates the file, maybe this is the difference? applicationHost.config can be found in the % SystemRoot% \ System32 \ inetsrv \ config . As you are working in a shared hosting environment, though it is not accessible to it, the other thing that happened to me is your configuration value path attribute is set to the default web site ; I think this will not be the name of your shared hosting website, I can only path Remove the attribute, so it applies the configuration to the current directory. Specify the incorrect equal to new ID on the secure connection under the ASP section in the IIS configuration (see image) for ASP Will happen. By default, ASP will create a new cookie while switching between a secure and unsecured connection, setting it to false will maintain the same cookie on HTTP and HTTPS.
Comments
Post a Comment