{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/4960","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/4960/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/4960/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/4960/events","html_url":"https://github.com/joomla/joomla-cms/issues/4960","id":47399407,"number":4960,"title":"Force-SSL causes a session dropping issue","user":{"login":"creativeprogramming","id":954291,"avatar_url":"https://avatars.githubusercontent.com/u/954291?v=3","gravatar_id":"","url":"https://api.github.com/users/creativeprogramming","html_url":"https://github.com/creativeprogramming","followers_url":"https://api.github.com/users/creativeprogramming/followers","following_url":"https://api.github.com/users/creativeprogramming/following{/other_user}","gists_url":"https://api.github.com/users/creativeprogramming/gists{/gist_id}","starred_url":"https://api.github.com/users/creativeprogramming/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/creativeprogramming/subscriptions","organizations_url":"https://api.github.com/users/creativeprogramming/orgs","repos_url":"https://api.github.com/users/creativeprogramming/repos","events_url":"https://api.github.com/users/creativeprogramming/events{/privacy}","received_events_url":"https://api.github.com/users/creativeprogramming/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/joomla/joomla-cms/labels/No%20Code%20Attached%20Yet","name":"No Code Attached Yet","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2014-10-31T14:25:36Z","updated_at":"2015-02-10T21:39:32Z","closed_at":null,"body":"To reproduce:\r\n\r\n0) Ensure your .htaccess/webserver is NOT doing http to https redirection\r\n1) Enable \"Force-SSL\" (whole site) in your Joomla system configuration (on an HTTPS capable joomla instance of course) \r\n2) Go to your website frontend in HTTPS and log in\r\n3) Open your site in plain http \r\n4) You get back redirected to SSL but.... session is lost you're logged out\r\n\r\nThis can be a nasty issue, as users may have bookmarked some http links, external links, and also it happens if they open another tab and they rely to the browser address bar suggestion (if it's stored as plain http).\r\n\r\n----\r\n\r\nTHIS ISSUE IS SOLVED IF YOU LET THE WEBSERVER HANDLE THE HTTP TO HTTPS REDIRECT \r\n\r\nSo it's 100% a Joomla issue. Maybe the redirect is not called before any session handling code and the session.php as cannot find a session cookie when is hit in https due to the \"secure cookie\" finds the user as guest and does some JSession initiation (session_destroy?) that destroies any existing https session, then it redirect the user back to https but with session lost\r\n\r\nSee:\r\n\r\nhttps://github.com/joomla/joomla-cms/blob/ac589fd45aaa88a5e9d972cacceec083cb4c754b/libraries/joomla/session/session.php#L814\r\n\r\nThis is good, but it's related to the issue, JSession should be fixed to avioid clearing on session initiation or the ForceSSL should be implemented in a way no other code is called but just the redirect!\r\n\r\nBest Regards,\r\nStefano\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/73789516","html_url":"https://github.com/joomla/joomla-cms/issues/4960#issuecomment-73789516","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/4960","id":73789516,"user":{"login":"spwilson806","id":5543773,"avatar_url":"https://avatars.githubusercontent.com/u/5543773?v=3","gravatar_id":"","url":"https://api.github.com/users/spwilson806","html_url":"https://github.com/spwilson806","followers_url":"https://api.github.com/users/spwilson806/followers","following_url":"https://api.github.com/users/spwilson806/following{/other_user}","gists_url":"https://api.github.com/users/spwilson806/gists{/gist_id}","starred_url":"https://api.github.com/users/spwilson806/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spwilson806/subscriptions","organizations_url":"https://api.github.com/users/spwilson806/orgs","repos_url":"https://api.github.com/users/spwilson806/repos","events_url":"https://api.github.com/users/spwilson806/events{/privacy}","received_events_url":"https://api.github.com/users/spwilson806/received_events","type":"User","site_admin":false},"created_at":"2015-02-10T21:39:32Z","updated_at":"2015-02-10T21:39:32Z","body":"I can confirm running into this problem as well (following the same procedure as described above).  It appears that the HTTP->HTTPS redirect happens during routing, after session handling/creation occurs.  If a user initially logs in while force_ssl is enabled, they receive a secure cookie.  If they then navigate to a non-HTTPS page, by definition, the cookie is not included in the request.  They are then given a new session, overwriting the existing one, prior to the redirect to HTTPS occurring.  "}}