Catalog goes HTTPS despite explicit HTTP setting

Hello Everyone!

Unexpected behaviour after customers log in:

Set up:

my checkout area is set to be accessed via HTTPS
my admin area is set to be accessed via HTTP
my catalog is supposed to be accessed via HTTP (not HTTPS)

Details:

here is an excerpt from my 'admin/includes/configure.php' :
/////////////////////////////////admin///////////////////////////////////////////////
define('HTTP_SERVER', 'http://www.mydomain.com');
define('HTTPS_SERVER', 'https://www.mydomain.com');
define('HTTP_CATALOG_SERVER', 'http://www.mydomain.com');
define('HTTPS_CATALOG_SERVER', 'https://www.mydomain.com');

// Use secure webserver for catalog module and/or admin areas?
define('ENABLE_SSL_CATALOG', 'false');
define('ENABLE_SSL_ADMIN', 'false');
///////////////////////////////admin/////////////////////////////////////////////////

and here's another excerpt from my regular 'includes/configure.php:
////////////////////////////
define('HTTP_SERVER', 'http://www.mydomain.com');
define('HTTPS_SERVER', 'https://www.mydomain.com');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');

// NOTE: be sure to leave the trailing '/' at the end of these lines if you make changes!
// * DIR_WS_* = Webserver directories (virtual/URL)
// these paths are relative to top of your webspace ... (ie: under the public_html or httpdocs folder)
define('DIR_WS_CATALOG', '/');
define('DIR_WS_HTTPS_CATALOG', '/');
////////////////////////////

What's going on:

My checkout works properly under HTTPS,
my admin area works properly under HTTP,
but
when a customer logs in, after the login page (which was served under HTTPS, of course), if he goes or gets redirected to catalog pages, he stays in HTTPS.
I need websuers to be http in the catalog.

I'm running on a brand new 1.3.8.a, PHP 5.2.5(Zend 2.2.0), static IP address, not-shared SSL cert.

Your input is greatly appreciated.

Thank you!

What is the SSL set to in the OTHER configure.php file ?

includes/configure.php

schoolboy:

What is the SSL set to in the OTHER configure.php file ?

includes/configure.php

Please see the original post above, it contains quotes from both files.

Thank you!

For what it's worth:

Drilling down through the code I found the following in the /includes/pages/login/header_php.php (line 137 in 1.3.8a):
/////////
zen_redirect(zen_href_link(FILENAME_DEFAULT, '', $request_type));
////////
This is the line of code that controls the actual redirect after login and all other login related checks.
It uses the original request type (which is HTTPS in case of login) and does not, seemingly, check where it's redirecting to: back to the catalog or forward to the checkout.

I would expect it to check the FILENAME_DEFAULT and if the filename belongs to the catalog area, then check the ENABLE_SSL_CATALOG setting, and then use the appropriate request type for the redirect.

Is it a bug or should I read it differently?

Thank you all!

I think this is a bug, but previous posts about it usually degenerate into discussions about the secure/non-secure error that is sometimes generated if the main page has non-secure content.

Best I can offer is this: http://www.zen-cart.com/forum/showthread.php?t=108133

There are a few other threads if you search for 'login secured'.

Thank you, stevesh!