We have an AWS ELB setup for our Magento application. The ELB strips away https:// and replaces it with http://. So in our nginx we make use HTTP_X_FORWARDED_PROTO to stop Magento from redirecting to an infinite loop by making it think it's using secure session. Now we have another problem, the session is being reset every time Magento tries to access the session cookie. This started happened after we upgraded to Magento 1.9.1. The upgrade introduced the following code in Varien.php

 if (Mage::app()->getFrontController()->getRequest()->isSecure() && empty($cookieParams['secure'])) {
    // secure cookie check to prevent MITM attack
    $secureCookieName = $sessionName . '_cid';
    if (isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])
        && $_SESSION[self::SECURE_COOKIE_CHECK_KEY] !== md5($cookie->get($secureCookieName))
    ) {
        $sessionHosts = $this->getSessionHosts();
        $currentCookieDomain = $cookie->getDomain();
        foreach (array_keys($sessionHosts) as $host) {
            // Delete cookies with the same name for parent domains
            if (strpos($currentCookieDomain, $host) > 0) {
                $cookie->delete($this->getSessionName(), null, $host);
        $_SESSION = array();
    if (!isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])) {
        $checkId = Mage::helper('core')->getRandomString(16);
        $cookie->set($secureCookieName, $checkId, null, null, null, true);
        $_SESSION[self::SECURE_COOKIE_CHECK_KEY] = md5($checkId);

As you can see the it checks for isSecure(), which is true because of HTTP_X_FORWARDED_PROTO. And then $cookieParams['secure'] is empty, I can assume because the session really is secure the cookie is for unsecured session. Whatever the reason it forces the cookies to be deleted.

Now User can't use session at all. Login, add to cart and checkout are all now working.

Anybody has any solution to this problem? I can't change how ELB is handling https:// and http://. So I am looking for an Nginx and Magento solution. Anybody has any ideas?

1 Answer 1


So after a long and hard look at what might be going wrong my colleague found the problem. There was code added to detect HTTP_X_FORWARDED_PROTO in the magento root index.php which is as following

    $_SERVER['HTTPS'] = 'on';
    $_SERVER['SERVER_PORT'] = 43;

This code would set https as on which makes magento work as secure and send a secure cookie back to the client on https. When the next request by client comes through on http (without secure cookie as secure cookies can't be transferred over http) magento still thinks it's on secure because of the code, so it looks for the secure cookie but fails to find it in the request. It then resets the session cookies thinking something might have gone wrong, destroying the session for the client. We didn't check if the HTTP_X_FORWARDED_PROTO was exclusively set when we are on secure https protocol. As it turns out it was always set regardless of protocol (http or https).

The check should actually have been like the following

          && $_SERVER['HTTP_X_FORWARDED_PROTO'] =='https') {
       $_SERVER['HTTPS'] = 'on';
       $_SERVER['SERVER_PORT'] = 443;

This fixed the problem for us.

  • good share dude
    – Amit Bera
    Commented Jan 5, 2016 at 6:07
  • obviously solution is very old, many results in google search dated 2012
    – MagenX
    Commented Jan 7, 2016 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.