Page 2 - non-SSL -> SSL page variable transfer? + your CF webhost?

I want to use session arrays to store and transfer data, not forms or URL transfer - I must write & read from sessions (SESSIONMANAGEMENT enabled in Application.cfm) - main point of sessions would be to prefill form on a secured page and that's why I need to find a way to store data and then read it and prefill the form. I don't want to use Access to store, although I could maybe, but I like sessions, they seems to be quick and effective


I must because there is no checkout, it's done manually - can you please suggest me best possible way to keep them secure - I have no Amazon's team, there are only me and myself

Thanks!

I think you're misunderstanding me. When I say you can pass the session's ID and Token in the URL, I don't mean passing the actual session DATA in the URL or Form. It works like this. CF has an identifier that is set on the users machine as a cookie. When the user requests a CF page that is using session variables, ColdFusion looks at the cookie. It reads the identifier out of the cookie and then looks in the CF server's memory. It finds the memory-resident session variables (arrays, etc.) that match up to the ID read from the user's cookie.

Now, instead of letting CF set a cookie on the user's browser to hold the ID, you can also pass it manually, like this:

http://mysite.com/index.cfm?#session.urltoken#

When this is executed, the variable session.urltoken is replaced by the user's id and token (something like "cfid=833737&cftoken=3984739743934").

When you do this, you are telling the CF server manually to associate the current user with that session identifier. So I think this would work even if jumping to another domain to do the SSL. The danger is that if a user emails such a link to someone else and that other user clicks on it, they may accidentally get the first user's session.

Regarding the CC number storage, you are really taking a risk by keeping the numbers. But if you think you have to, then every day (or even a few times a day) copy the CC numbers over to a database that is NOT accessible by the internet and then delete the numbers from the first database. Be very careful on this, you can indeed be sued if someone proves a lack of security on your part lead to card numbers being compromised.