I'm working with a very complex legacy D7 site, and very complex requirements (bleaugh).

Anyway: I'm working on a deeplinking system that allows a jump to the site, which then logs-in a user (this is based on an encrypted ID), does some other stuff like setting up cookies, and then jumps to the required page.

This is fine, except some of them are HTTP pages, which work, and some are HTTPS, which don't.

What happens is that when it arrives on the required page there is no logged-in user (so "Access Denied"). But if I then go to an HTTP page (like the front page), the user is logged in.

So clearly I need to set up the HTTPS session data before jumping to the required page. I've been through the Drupal session code but I can't figure it out.

I need to set the SSESSPHPID cookie and possibly some other stuff - but what and what's right? Any help would be appreciated.

  • Maybe you can try the secure_login module. It may be helpful for your situation.
    – guilhom
    Jul 7, 2017 at 14:38
  • 1
    It would probably be better to do a redirect directly in apache rather than in Drupal.
    – mradcliffe
    Jul 7, 2017 at 15:00

1 Answer 1


Long story short: It wasn't Drupal. We have the Brocade Traffic management stuff running above the site (and on local sites too so the dev environment is as close to live as possible).

The HTTP/HTTPS switching in that was causing the problem. After working with it for so long I should have checked it. Such is the life of a professional developer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.