Gigya not compatible with the Secure Pages Hijack Prevention module

I don't know if this is actually possible due to the nature of SSL, unless you set up a CNAME alias for Gigya's authentication site so that the session cookie could be shared between that domain and your secure domain.

Same problem. This is actually very bad news :-(

Actually, it seems that what prevents Gigya from working is not the Secure Pages module, but it's little brother that tightens security even more, namely Secure Pages Hijack Prevention module.

I've had both SP and SPHP modules on, I would log in via/user using Gigya, it would log me in http, but then any attempt to visit an admin page (over SSL) gave me access denied.

After I switched off SPHP, Gigya logs me in via http, and when I click on an admin page, it shows all right over SSL. Try it!

Of course, it is less secure, so it is not a satisfactory solution. Would be great if Gigya was made compatible with SPHP.

Adjusting issue title, and the Gigya version tested.

Thanks for the updated info vacilando. I will take a look at this but am not very familiar with Secure Pages so I'd welcome whatever help you might be able to bring to the table.

For this to work, the paths /socialize-login and /socialize-register need to be accessed via SSL. Securepages hijack prevention needs to set a secure cookie, and it can't do that if user_external_login() is called from an insecure page. Probably the way to accomplish this would be an extra checkbox on admin/settings/gigya, something like "always use HTTPS logins".

Could somebody please look into this - maybe using grendzy's suggestion, which, if true, seems to be very easy to code?

Because as it is, Gigya is totally incompatible with the Secure Pages Hijack Prevention module :-(

Gigya's 6.x module is deprecated. We no longer maintain this version. We encourage upgrading to our latest module.