i don't know how i can explain my situation exactly. i am no developer or a geek. so i try to explain my problem so simple as i can.
how it have to work:
there are two urls and protocols.
http://normal.url.org/hcms
https://secure.url.org/hcms
to login into the drupal page, i will use ssl. to edit or create forum topics i will use normal http as authenticated user. to change user settings or administer the site i switch to ssl.
the post core update problem:
login via ssl works fine. switch to an defined non ssl site drop the login status or what ever. it looks like you are logged out. if you use the browser back button to go back you are also back in your session. ???
i run into this ssl problem after an core update to 6.20. before this update everything work as expected.
here my working(pre update) setting files.
apache sites-available files. *only the needed information witch non real urls
my.site.file
RewriteCond %{REMOTE_HOST} !an.ip.add.res
RewriteRule ^/hcms/(../)?(user|cart|admin) \
https://secure.url.org%{REQUEST_URI} [R=301,L]
----8<---------------------------
my.secure.site.file
ProxyPass /hcms/ http://normal.url.org/hcms/
ProxyPassReverse /hcms/ http://normal.url.org/hcms/