Scenario: I'm on my web site <http://domain.com/>, and see some content I need to moderate. I click an 'admin this page' link to open in a new tab which sends me to <https://domain.com/myadmin/> and I re-authenticate, navigate to the appropriate moderation panel of my site, do my work, and typically leave that tab open.

Now back on the non-SSL version of the site, I click around to other pages, etc., see something else to moderate, and whether I go back to my old https: //domain.com/myadmin/ tab, or open another new https: //domain.com/myadmin/ tab, suddenly my old session is gone, and I have to re-authenticate.

Currently, our session data is stored in Memcache. Our SSL-enabled node is a single machine. Our non-SSL site is load balanced across more than a dozen nodes. All nodes share a common code base via NFS, so the code is identical on all nodes, secure or not.

After doing lots of lurking and reading, I wondered if it had something to do with php.ini's setting of session.cookie\_secure ... but since we force everyone using the secured /myadmin/ panel to re-authenticate, it seems that the secured session is just disappearing.

I think the problem is local to the node which answers to the SSL requests. If we open a tab to https: //domain.com/myadmin/ and log in, and then remove the /myadmin/ path and just navigate around our entire site as https: //domain.com/ it seems our session never disappears. But as soon as we click a link in the browser that forces us to the non-secure version of the site, our secure session goes poof.