Laravel 5.1中如何在HTTP与HTTPS间保持Session存活？

Hey there! Let's break down why your current setup isn't working and walk through how to fix it:

为什么设置'secure' => true会导致HTTP无法登录？ #

When you set secure => true for your session cookie, you’re telling browsers only send this cookie over HTTPS connections. That means any HTTP request (like your main site pages) won’t include the session cookie at all—so your app can’t recognize logged-in users on HTTP, which explains the login failures and broken functionality there.

让Session跨HTTP/HTTPS存活的配置调整 #

To make sessions work across both protocols, you need to tweak your cookie settings while balancing functionality and security:

• Set secure => false: This allows the session cookie to be sent over both HTTP and HTTPS. This is mandatory for your mixed-protocol setup right now.
• Keep http_only => true: This is a critical security practice to prevent XSS attacks from accessing the session cookie—definitely keep this enabled.
• Configure the correct domain: Set your session cookie’s domain to your root domain with a leading dot (e.g., .ourdomain.com). This ensures the cookie is shared across all subdomains and both HTTP/HTTPS versions of your site.
• Check the SameSite attribute: Set this to Lax (the default in most modern browsers) to allow the cookie to be sent when navigating between HTTP and HTTPS pages. Avoid Strict if you need cross-protocol navigation, and note that None requires secure => true (which isn’t an option here).

Example configuration (adjust based on your framework/language):

// PHP direct configuration
session_set_cookie_params([
    'lifetime' => 3600,
    'path' => '/',
    'domain' => '.ourdomain.com',
    'secure' => false,
    'httponly' => true,
    'samesite' => 'Lax'
]);

// Laravel example (config/session.php)
return [
    // ...
    'cookie' => [
        'name' => 'laravel_session',
        'domain' => '.ourdomain.com',
        'secure' => false,
        'http_only' => true,
        'same_site' => 'lax',
    ],
    // ...
];

长期建议：迁移到全站HTTPS #

While the above fixes your immediate issue, running a mixed HTTP/HTTPS site carries security risks (like mixed content warnings and potential man-in-the-middle attacks on HTTP pages). It’s highly recommended to:

1. Redirect all HTTP traffic to HTTPS using your web server config (Apache/Nginx) or a load balancer.
2. Once your entire site is HTTPS-only, you can set secure => true again to lock down session cookies to secure connections.

内容的提问来源于stack exchange，提问作者Wondering Coder