title: PHP Session gets lost: Subdomains AND https (SSL to non-SSL)
body: <p>I think I read and tried all relevant topics about "sessions, cross-domain and ssl" here on stackoverflow . Unfortunately nothing works.</p>
  
  <p>My case:  </p>
  
  <blockquote>
    <p>loginForm.html (non-SSL) -> authUser.php (SSL) -> showAccount.php (non-SSL)</p>
  </blockquote>
  
  <p>The problem is, that these files are placed on different subdomains and served by SSL or non-SSL.</p>
  
  <blockquote>
    <p>loginForm.html  -> <a href="http://dev.domain.com" rel="nofollow noreferrer">http://dev.domain.com</a><br>
    authUser.php    -> <a href="https://ssl.domain.com" rel="nofollow noreferrer">https://ssl.domain.com</a><br>
    showAccount.php -> <a href="http://dev.domain.com" rel="nofollow noreferrer">http://dev.domain.com</a></p>
  </blockquote>
  
  <p>If the user credentials are correct, the <code>authUser.php</code> should create the session which is used by <code>showAccount.php</code>. </p>
  
  <p>As already mentioned, I tried all posted solutions.
  For reference let's take a look at this: <a href="https://stackoverflow.com/questions/441496/session-lost-when-switching-from-http-to-https-in-php">Session lost when switching from HTTP to HTTPS in PHP</a> .<br>
  I also tried to extend this snippet with <code>session_set_cookie_params</code> as mentioned in <a href="https://stackoverflow.com/questions/1064243/php-sessions-across-sub-domains/1457582#1457582">PHP Sessions across sub domains</a> but this neither works.<br>
  I also tried <code>ini_set('session.cookie_domain', '.domain.com');</code></p>
  
  <p><strong>Edit: As in the answers requested, here is the used code</strong> (which was originally posted by Jacob here: <a href="https://stackoverflow.com/questions/441496/session-lost-when-switching-from-http-to-https-in-php/441775#441775">Session lost when switching from HTTP to HTTPS in PHP</a>)</p>
  
  <p><strong><a href="https://ssl.domain.com/user/authUser.php" rel="nofollow noreferrer">https://ssl.domain.com/user/authUser.php</a></strong></p>
  
  <pre><code>&lt;?php
  
  // auth with database was successful, so create the session
  
  session_set_cookie_params(0, '/', '.domain.com'); 
  session_start();
  
  $currentSessionID = session_id();
  $_SESSION['testvariable'] = 'It worked';
  $InsecureServerDomain = 'dev.domain.com';
  $pagePath = '/showAccount.php';
  
  echo '&lt;a href="http://' . $InsecureServerDomain . $pagePath . '?session=' . $currentSessionID . '"&gt;Transfer Cookie from secure to insecure &lt;/a&gt;';
  
  ?&gt;
  </code></pre>
  
  <p><strong><a href="http://dev.domain.com/showAccount.php" rel="nofollow noreferrer">http://dev.domain.com/showAccount.php</a></strong></p>
  
  <pre><code>&lt;?php
  
  $currentSessionID = filter_input(GET, "session");
  session_set_cookie_params(0, '/', '.domain.com'); 
  
  session_id($currentSessionID);
  
  session_start();
  
  if (!empty($_SESSION['testvariable'])) {
        echo $_SESSION['testvariable'];
  } else {
        echo 'It did not work.';
  }
  
  ?&gt;
  </code></pre>
  
  <p>The <code>$_SESSION</code> is always empty.</p>
  
  <p>Are there any hints?</p>