3.2. I have a different secure server domain. Why does the shopping cart get dropped?
First of all, it is questionable business practice to not certify your secure server. Besides violating the terms of use of many certificate issuers, customers notice the changed domain and it is proven by user surveys and long experience that you will receive fewer orders as a result. Certs can be obtained for $125 US per year, less than the typical cost of one hour of a top consultant's time. Do your business a favor -- spend the money to get a cert.
If you insist on doing it anyway, probably driven by the fact that you need a dedicated IP address for a secure server, you can use the solutions in the previous FAQ question and get some relief.
But by far the best way is to have all orders and shopping cart calls go only to the secure domain. Your users may get a different session when browsing the non-secure catalog pages, but it will matter little.
To do this on the Foundation demo, place in catalog.cfg:
AlwaysSecure order ord/basket ord/checkout
A more complete list might be:
AlwaysSecure <<EOF account change_password customerservice login logout new_account ord/basket ord/checkout order process query/check_orders query/order_detail query/order_return returns saved_carts ship_addresses EOF
Add pages of your own that need to be sure of coherent session information.
For all *forms* to be secure, make sure "process" is on that list. (Your search forms will still be non-secure if you use "[process-search]" to produce the form ACTION.)
To make individual order links secure, use this instead of "[order]":
<A HREF="[area href=order secure=1 form='mv_order_item=SKU_OF_ITEM' ]">Order it</A>
To make a form-based order button secure, use "[process secure=1]" as the ACTION.