title: Pass and restore a session id in zend framework
body: <p>First, yes i know this is a big security <strong>NONO</strong>. But the scenario is this;</p>
  
  <p>In the checkout of a webshop i use a payment-gateway, which can proxy my checkout form through their SSL.</p>
  
  <p>(following url's is just the theory, other urls apply for the application)</p>
  
  <p>The way it works, website redirects user to their <strong>https</strong>://gateway.org/secure-tunnel.php passing a url in the query like this ?url=<a href="http://myshop.com/cc-form.php" rel="nofollow noreferrer">http://myshop.com/cc-form.php</a> &lt;- needs to be urlencoded.</p>
  
  <p>The secure-tunnel requests the url - sprinkle some magic on url in the document - and shows it to the user.</p>
  
  <p>Now i want to pass the session ID to the cc-form.php url, and got that part working. BUT the requested page don't pick up the session ID that is passed.</p>
  
  <p>Any ideas on that?</p>
  
  <p>The following is from my application.ini</p>
  
  <pre><code>resources.session.name = UPSSESSID
  resources.session.save_path = APPLICATION_PATH "/../data/session"
  resources.session.use_only_cookies = off
  resources.session.referer_check = off
  resources.session.remember_me_seconds = 864000
  </code></pre>
  
  <p>Also while researching i found that the Suoshin extension could be causing some problems, so i have added this to the .htaccess</p>
  
  <pre><code>php_flag suhosin.session.cryptua off
  </code></pre>
  
  <p>I use a route to my payment form</p>
  
  <pre><code>$this-&gt;_helper-&gt;url-&gt;url(array(session_name() =&gt; Zend_Session::getId()), 'payment')
  </code></pre>
  
  <p><strong>EDIT: Possible, rather dodgy solution</strong> </p>
  
  <p>I actually managed to restore the session by inserting this to <code>_initApplication()</code> in my bootstrap file. It's rather dodgy, so if anyone knows of a better - more ZF'ish - way please advice!</p>
  
  <pre><code>    if(isset($_GET[$appConfig-&gt;resources-&gt;session-&gt;name])) {
          session_id($_GET[$appConfig-&gt;resources-&gt;session-&gt;name]);
      }
  </code></pre>
  
  <p><strong>EDIT: DOH!</strong></p>
  
  <p>Well.. turns out previous edit is not needed. Just before i added the previous lines to the bootstrap i also changed the url layout.</p>
  
  <p>Changed it from <code>/pay/UPSSESSID/{session-id-here}</code> to <code>/pay?UPSSESSID={session-id-here}</code> - And that was actually the root of the problem :(</p>
  
  <p>Now i have removed the lines from the bootstrap and the sessionId i restored correctly.</p>
  
  <p>My mistake!</p>