Incompatibility between Persistent Login and Secure Pages Hijack Prevention

Hi,

We just started using your module, and have been using securepages_prevent_hijack to help prevent session cookie theft over open networks.

We discovered that when the user gets logged in by persistent_login over HTTP, the securepages_prevent_hijack module doesn't write its special SSL_SESS* HTTPS-only cookie, and so will boot the user back out next time they hit an HTTPS page.

I created a patch for your module initially that forces a redirect to an HTTPS page before doing the actual login, which causes the SSL cookie to be written properly, but then realised that I'd broken the fundamental purpose of securepages_prevent_hijack, as the persistent cookie could be stolen just as easily and reused, creating a full SSL session from a non-SSL cookie. I'm aware there's some mitigation in your module to prevent cookie theft, but it's a different and incompatible approach...

I've attached the patch in case you're interested, but I think the solution for now will be to stop using securepages_prevent_hijack and live with a bit of risk. I'm not sure what the long-term solution to this should be.

I was thinking maybe you could note it under "known issues" on the project page that this incompatibility exists though.