title: PHP session HTTP to HTTPS problem
body: <p>I have a (HTTPS) login.php page which remains HTTPS (ie once user logged in goes to account dashboard). Now the problem is say the user whilst logged on to the secure dashboard clicks onto a non-sensitive page like (HTTP) about-us.php page, the session is not transmitted over HTTP as I have session.cookie_secure=1, meaning the user appears logged out on HTTP pages. </p>
  
  <p>However when the user goes back to dashboard page or any sensitive account page I have been told he should still be logged in (ie from HTTP back to HTTPS)? However  this is not the case and he appears logged out on the HTTPS connection too? </p>
  
  <p>I believe I am missing something which is causing this problem. Here is my code:</p>
  
  <p>This is PHP header file which is called to start session on login.php page:</p>
  
  <pre><code>session_start();
  session_regenerate_id(true); /*avoid session fixation attempt*/
  
  /*Create and check how long session has been started (over 5 mins) regenerate id - avoid session hijack*/
  if(!isset($_SESSION['CREATED'])) 
  {
      $_SESSION['CREATED'] = time();/*time created session, ie from login/contact advertiser/email_confirm only ways for new session to start*/
  } 
  elseif(time() - $_SESSION['CREATED'] &gt; 300) 
  {
      /*session started more than 5 mins(300 secs) ago*/
      session_regenerate_id(true); /*change session ID for the current session and invalidate old session ID*/
      $_SESSION['CREATED'] = time(); /*update creation time*/
  }
  
  /*Check if user is logged in*/
  if(!isset($_SESSION['loggedin']))
  {
      $_SESSION['loggedin']=1;/*used to track if user is logged in on pages*/
  }
  
  /*if return false browser supports standard ob_start();*/
  if(ob_start("ob_gzhandler")){ob_start();}
  </code></pre>
  
  <p>This is PHP header file required on every page to check if session initiated already:</p>
  
  <pre><code>session_start(); 
  
  $session_errors=0;/* if&gt;0 user not logged in*/
  
  /*check if session is already initiated*/
  if(isset($_SESSION['CREATED'])) 
  {
      if(time() - $_SESSION['CREATED'] &gt; 300) 
      {
          /*session started more than 5 mins(300 secs) ago*/
          session_regenerate_id(true); /*change session ID for the current session and invalidate old session ID*/
          $_SESSION['CREATED'] = time(); /*update creation time*/
      }
  }
  elseif(!isset($_SESSION['CREATED'])){$session_errors++;}/*user not logged in*/
  
  /*Check if user is logged in*/
  if(!isset($_SESSION['loggedin'])){$session_errors++;}/*user not logged in*/
  
  if(ob_start("ob_gzhandler")){ob_start();}
  </code></pre>
  
  <p>Also if any use this is the code to turn HTTPS of on non-sensitive pages such as about-us.php</p>
  
  <pre><code>if ($_SERVER['SERVER_PORT']!=80)
  {
  $url = "http://". $_SERVER['SERVER_NAME'] . ":80".$_SERVER['REQUEST_URI'];
  header("Location: $url");
  }
  </code></pre>
  
  <p>My php.ini file cookie settings</p>
  
  <pre><code>session.cookie_secure=1
  session.cookie_httponly=1
  session.use_only_cookies=1
  session.cookie_lifetime = 0
  session.save_path = /tmp
  session.save_handler = files
  </code></pre>