silverstripe/silverstripe-framework — pull request #2201 by hafriedlander (2013-07-06 03:22:27+00:00)
Title: Fixes to session, primarily around cookie_secure

Session::$cookie_secure adds the secure property to the session Set-Cookie
command, so that the browser wont send it to the server over an unencrypted
link. However the server will still send the cookie to the browser
unencrypted. Also Sessions dont work in HTTP (since the browser wont
send the cookie) but SilverStripe needs them for several things, such as form
validation.

This patch effectively causes HTTP and HTTPS requests to each have
their own session when cookie_secure is true. The two sessions are
independant from each other, so information set in the session via
HTTPS is safe from attacks on the session via HTTP, but parts
of the site that use HTTP and the session will still work