I work on a Drupal site which has multiple domains (not sub-domains) using Domain Access to set different themes, display different content, etc. on each of them. These multiple domains are used for canonical HTTP URLs. Each domain also has a corresponding sub-domain of a common domain which is used with Secure Pages for HTTPS (there's a wildcard certificate). This all works fine.

My next step is to manage to unify the session between HTTP (on the canonical domain) and HTTPS (on the sub-domain of the shared domain). Many other sites accomplish this by redirecting back to their main domain to assign or discover the session cookie and redirect back to a "set cookie" script on the the current domain to set it there too.

A semi-serious search of D.O and with Google didn't turn up anything useful so I'll ask here: has anyone done this before in Drupal before? Is there a module or (more likely) a patch I can use and am I on my own here?

Thanks for any suggestions.


2 Answers 2


There are some related answers and solutions at "Enterprise" authentication, single sign-on and user provisioning for multiple sites.

While you have a more specific question, the goal is similar to what many SSO solutions in Drupal try to achieve.

  • @kiamlaluno: just curious, why remove the ´ quotes? I added them, to make clear that the linked sentence is not mine, but quoted from elsewhere. And I used and ´ to differentiate from the already used "" in the quoted text.
    – berkes
    Sep 9, 2011 at 11:42
  • 1
    It's a link; it is already evident what part is the one used as link title. If you want to quote the title (if that would be necessary, as the link title is already rendered differently from the browsers), then you should use the single quotation marks, such as in '"Enterprise" authentication, single sign-on and user provisioning for multiple sites.'
    – apaderno
    Sep 9, 2011 at 11:49

Sending secured session to unsecured sites is not a good way; you can just pass some variables that not affect your security (e.g., via $_GET). Read also Session lost when switching from HTTP to HTTPS in PHP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.