3.2. I have a different secure server domain. Why does the shopping cart get dropped?
First of all, it is questionable business practice to not certify your secure server. Besides violating the terms of use of many certificate issuers, customers notice the changed domain and it is proven by user surveys and long experience that you will receive fewer orders as a result. Certs can be obtained for $125 US per year, less than the typical cost of one hour of a top consultant's time. Do your business a favor -- spend the money to get a cert.
If you insist on doing it anyway, probably driven by the fact that you need a dedicated IP address for a secure server, you can use the solutions in the previous FAQ question and get some relief.
But by far the best way is to have all orders and shopping cart calls go only to the secure domain. Your users may get a different session when browsing the non-secure catalog pages, but it will matter little.
To do this on the Foundation demo, place in catalog.cfg:
AlwaysSecure order ord/basket ord/checkout
A more complete list might be:
AlwaysSecure <<EOF
account
change_password
customerservice
login
logout
new_account
ord/basket
ord/checkout
order
process
query/check_orders
query/order_detail
query/order_return
returns
saved_carts
ship_addresses
EOF
Add pages of your own that need to be sure of coherent session information.
For all *forms* to be secure, make sure "process" is on that list. (Your search forms will still be non-secure if you use "[process-search]" to produce the form ACTION.)
To make individual order links secure, use this instead of "[order]":
<A HREF="[area href=order secure=1 form='mv_order_item=SKU_OF_ITEM' ]">Order it</A>
To make a form-based order button secure, use "[process secure=1]" as the ACTION.