Seems like I found the problem:
app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
The following code was added:
if (Mage::app()->getFrontController()->getRequest()->isSecure() && empty($cookieParams['secure'])) {
// secure cookie check to prevent MITM attack
$secureCookieName = $sessionName . '_cid';
if (isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])
&& $_SESSION[self::SECURE_COOKIE_CHECK_KEY] !== md5($cookie->get($secureCookieName))
) {
session_regenerate_id(false);
$sessionHosts = $this->getSessionHosts();
$currentCookieDomain = $cookie->getDomain();
foreach (array_keys($sessionHosts) as $host) {
// Delete cookies with the same name for parent domains
if (strpos($currentCookieDomain, $host) > 0) {
$cookie->delete($this->getSessionName(), null, $host);
}
}
$_SESSION = array();
}
if (!isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])) {
$checkId = Mage::helper('core')->getRandomString(16);
$cookie->set($secureCookieName, $checkId, null, null, null, true);
$_SESSION[self::SECURE_COOKIE_CHECK_KEY] = md5($checkId);
}
}
I'll try to find a workaround for this...
UPDATE:
We managed a workaround by reloading the saved quote from a GET param on the callback URL, something like this:
if($this->getOnepage()->getQuote()->getId() == null){
$rqQuoteId = Mage::app()->getRequest()->getParam('qid');
$this->getOnepage()->setQuote(Mage::getModel('sales/quote')->loadActive($rqQuoteId));
$customer_id = $this->getOnepage()->getQuote()->getData('customer_id');
if(!is_null($customer_id)){
$customer = Mage::getModel('customer/customer')->load($customer_id);
if(!is_null($customer)){
Mage::getSingleton('customer/session')->setCustomerAsLoggedIn($customer);
}
}
}
Have in mind that this would represent a security risk if anyone can run that URL, make sure it can only be ran once.
If you are saving custom data on the session you'll need to save it on the db, and reload it afterwards. Hope it helps.