https和http之间的PHP SESSION变量

Question

I have a website that has a secure area (https) and the rest of the site, which is http. Everything works wonderful using session variables to login on the https side of things, and the secured area is functioning wonderfully.

My issue: I have a "login/register" button at the top of every http page on the site. I would like this to reflect login status and change to "logout" and also have some other logged in buttons that simply redirect to the https pages. I am not trying to manipulate any data or other secured info on the http pages in any way.

In IE8 the https created session variable for login is detected in http (on the home page) and it correctly displays the alternative "log out" link. However, in all other browsers the session variable is not there in http. What is the easiest way to fix this without creating a huge security flaw? Oh, and the urls are the same except for http and https.

Answer 1

许多站点使用的一种简单方法是通过脚本向客户端实际加载按钮，该脚本向HTTPS url发出请求以确定用户是否登录，而不是使用HTML它是HTTP服务页面的一部分。

Answer 2

If you want to secure session cookie, you want to make sure the browser only send out the cookie in HTTPS. Therefore, any way to figure out login status from HTTP communication is insecure.

I +1 the solution Amber posted.