Yes, I was speaking generically when I mentioned that the SID follows the user thru the site. Allow me to elaborate ... though you've guessed right.

I'm using CGI::Session to create a session file on the server. I "pass" the SID via the query string (usually, but not always, in a hidden context). I'm also utilizing TT2 (Template Toolkit ... a great template tool btw) so passing the SID to my various templates in a hash is easy.

More specifically though, my code fails immediately after I instantiate the session object upon successful user authentication. As soon as this is done I redirect the user to a non-secure HTTP connection to the same domain.

So I start by having the user login here:

https://mydomain.com/cgi-bin/index.cgi

And then I redirect to here ...

print "Location: http://www.mydomain.com/cgi-bin/index.cgi?sid=$sid\n\
+n";
[download]

Now, when I created my SSL cert, I neglected to use www in the domain. I'm not sure if this is an issue. I plan to create another cert that includes the www so that both variations can be used to connect securely to the site.

Otherwise, the only difference is the HTTP vs. HTTPS connection type.

Now, downstream of what I've shared here is where I run into problems. Once the authentication process is complete, the user goes on his/her merry way utilizing various functionality in the site. These additional pieces of functionality are governed by other CGI's. When any of these CGI's is invoked, I run a simple subroutine check to make sure the user's SID is valid:

my $sid = $cgi -> param('sid') || undef; # retrieve session id from qu
+ery string
    my $session = new CGI::Session("driver:File", $sid, {Directory => 
+'/home/mysite/public_html/tmp'});
    my $session_email = $session -> param('session_email'); # retrieve
+ encrypted email (username) from session object
    my $session_uid = $session -> param('session_uid'); # retrieve uid
+ (user's id) from session object

# if session file doesn't have email or uid info, kill cgi!
    if (($session_email eq '') || ($session_uid eq '')) {
        print "Location: http://www.mysite.com/cgi-bin/authentication_
+error.cgi\n\n";
        exit;
    }
[download]

This last line of code is where things are getting hung up. The session file still exists on the server (I've checked) and the SID is still attached to the user (via the query string) but the CGI can't see $session_email or $session_uid so it terminates the user.

This is ONLY happens when I change to HTTPS ... though the www is also "currently" missing from the domain ... as explained above.

Hope this helps to clarify my problem, thanks for your help. I've done some "speed trials" this morning (running the CAD data through a secure connection). It is something we "might" be able to live with though we were hoping to go the other route.

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.