title: POSTing to https form not always working
body: <p>On my site I have a simple login form. The page is served via HTTP, but the form's POST URL is HTTPS.</p>
  
  <p>The normal method is that the user fills in their username/password, the form is submitted (to the fully qualified HTTPS URL, on the same site), and then the POST processing does a 303 redirect to the users' homepage. But sometimes this doesn't happen.</p>
  
  <p>The cycle (and this is 100% repeatable) is this:</p>
  
  <ol>
  <li>Visit login form, fill in details and submit</li>
  <li>On the server the login script gets called, validates the data and then , if all is well, does a 303 redirect to the users home page.</li>
  <li>I then click logout and then click login, at which point I'm taken back to the login form</li>
  <li>I then fill in my details again, hit submit.</li>
  <li>This time, however, the login logic doesn't execute (the debug code that logged the login at step 2 doesn't get called), and yet I'm still redirected to the users homepage. But because I've not been logged in successfully, I get kicked out to the front page...</li>
  </ol>
  
  <p>So why isn't the POST always calling the login form? I don't think the 303 is being cached (and it shouldn't be, according to the spec)...</p>
  
  <p>Looking at the HTTPS logs in the server, login.phpo is being called the first time, but not the second....</p>
  
  <p><strong>Edit:</strong></p>
  
  <p>OK, we've solved the problem. For those that are interested:</p>
  
  <p>The site is run on 2 webservers behind a load balancer. user sessions are 'sticky' - that is to say once a user is browsing on one web server the LB will keep them 'attached' to that server. This is done via a cookie. But once we switch to HTTPS the LB can't read the cookie, as the connection is encrypted between the browser and web server. So it was alternating between servers. WWe have code to propagate login authentications between webservers, but this wasn't happening fast enough. So what was happening was:</p>
  
  <ol>
  <li>User browsers to server A, gets a cookie saying 'keep me on A', fills in their login credentials and hits submit</li>
  <li>The LB, being unable to decipher the HTTPS traffic (and thus the cookie), sends them 50% of the time to B</li>
  <li>B validates the login and sets the user to be authenticated in the session, before redirecting the user to the non https homepage</li>
  <li>Because the homepage is non https, the LB reads the cookie and sends them to A, which knows nothing of the authentication since it wasn't propagating fast enough from B...</li>
  </ol>
  
  <p>The solution was to allow the LB to decrypt HTTPS traffic, thus ensuring that users really do stay on one web server, regardless of HTTP/HTTPS transitions.</p>