Re: When moving between HTTP and HTTPS, how to share authentication cookies (ACSID, SACSID)?

[Emanuele Ziglioli]

We use Vosao's authentication system and I've been trying to share session cookies between https and http using CORS but browser support is still inconsistent.

If you use Java, that's what I've been using:  http://software.dzhuvinov.com/cors-filter.html 


On Friday, 24 August 2012 17:28:22 UTC+12, Ben Alpert wrote:

I'm attempting to set up my app so that certain pages can be served over HTTPS but most are served over HTTP:

If I log in to my app with a Google account over HTTPS, then the SACSID cookie gets set which causes App Engine to happily return the proper account when users.get_current_user() is called.

Unfortunately, when I return to the HTTP version of my site, App Engine seems to look for the ACSID cookie instead, which isn't present, so users.get_current_user() returns nothing.

Is there a way I can configure App Engine to honor the SACSID cookie over HTTP or some way to transfer the cookie between the two? (The cookies don't use the same value; simply copying the cookie appears not to work.)

Thanks,

Ben

[roshan]

Hi,

Can anyone throw some light on this matter please? I am struggling to know its answer too today.

Regards,

Roshan

[Vinny P]

On Thu, Feb 27, 2014 at 1:06 AM, roshan <roshan...@gmail.com> wrote:

Can anyone throw some light on this matter please? I am struggling to know its answer too today.

On Friday, 24 August 2012 10:58:22 UTC+5:30, Ben Alpert wrote:

Is there a way I can configure App Engine to honor the SACSID cookie over HTTP or some way to transfer the cookie between the two? (The cookies don't use the same value; simply copying the cookie appears not to work.)

There's no way to do this. SACSID cookies are only sent over a secure connection - they won't be supplied over the unsecure HTTP connection. And you can't clone the SACSID cookie into ACSID. 

The best fix would be to keep your entire website as HTTPS, and force HTTPS if the current browser is using HTTP

 

 

-----------------

-Vinny P

Technology & Media Advisor

Chicago, IL

App Engine Code Samples: http://www.learntogoogleit.com