https 和 http 之间的 PHP SESSION 变量
我有一个网站，有一个安全区域 (https) 和网站的其余部分，即 http。使用会话变量在 https 端登录，一切都运行良好，并且安全区域运行良好。
我的问题： 我在网站上每个 http 页面的顶部都有一个“登录/注册”按钮。我希望这能够反映登录状态并更改为“注销”，并且还有一些其他登录按钮可以简单地重定向到 https 页面。我不想以任何方式操纵 http 页面上的任何数据或其他安全信息。
在 IE8 中，在 http（主页上）中检测到 https 创建的用于登录的会话变量，并正确显示替代的“注销”链接。但是，在所有其他浏览器中，http 中不存在会话变量。在不造成巨大安全漏洞的情况下解决此问题的最简单方法是什么？哦，除了 http 和 https 之外，url 都是相同的。
I have a website that has a secure area (https) and the rest of the site, which is http. Everything works wonderful using session variables to login on the https side of things, and the secured area is functioning wonderfully.
My issue:
I have a "login/register" button at the top of every http page on the site. I would like this to reflect login status and change to "logout" and also have some other logged in buttons that simply redirect to the https pages. I am not trying to manipulate any data or other secured info on the http pages in any way.
In IE8 the https created session variable for login is detected in http (on the home page) and it correctly displays the alternative "log out" link. However, in all other browsers the session variable is not there in http. What is the easiest way to fix this without creating a huge security flaw? Oh, and the urls are the same except for http and https.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
许多网站使用的一种简单方法是通过脚本在客户端实际加载按钮，该脚本向 HTTPS url 发出请求以确定用户是否登录，而不是使用 HTML它是 HTTP 服务页面的一部分。
One simple way to do it that many sites use is to have the button actually be loaded client-side via a script that makes a request to an HTTPS url to determine whether or not the user is logged in, as opposed to having the HTML for it be part of the HTTP-served page.
如果您想保护会话 cookie，您需要确保浏览器仅以 HTTPS 方式发送 cookie。因此，任何从 HTTP 通信中找出登录状态的方法都是不安全的。
我+1 Amber 发布的解决方案。
If you want to secure session cookie, you want to make sure the browser only send out the cookie in HTTPS. Therefore, any way to figure out login status from HTTP communication is insecure.
I +1 the solution Amber posted.