Session in SSL

[Adil Akram]

I've developed a shopping cart application in ASP. To maintain the shopping
cart session, I've used the session ID, but while it shifts to SSL pages,
the session ID changed which is its default behaviour to maintain security
and prevent session stealing.

I've no idea to maintain session in shopping cart with SSL in check out form
because if I do it with cookies the same security problem exist there,
anyone can steal cookie in non SSL pages and can use it at any time in
user's session.

Expert advices are really appreciated.

I'm thankful in advance.

regards,
Adil
(e-mail address removed)

 

[Ray Costanzo [MVP]]

See here, http://www.aspfaq.com/show.asp?id=2157, and note the link to the
cookieless shopping cart that uses a DB to maintain session data.

Ray at home