Take the 2-minute tour ×
ExpressionEngine® Answers is a question and answer site for administrators, end users, developers and designers for ExpressionEngine® CMS. It's 100% free, no registration required.

This has been a continuous issue with ExpressionEngine - admins having to clear their cookies to login to the site.

Even when typing in the correct username and password, the user is return back to the control panel login page with no error message. How do you prevent this?

share|improve this question
    
Is this a Chrome-only issue? Does changing your session type to be sessions only help? –  Tyssen Nov 27 '12 at 21:47
    
I've had it across all browsers for about 5 years. My guess it is because we're behind a dynamic IP address, but I'd like to hear some ideas. –  Richard Frank Nov 27 '12 at 21:50
    
I don't have to clear my cookies, but after having my session timed out for a while the next time I try to login I get no error or anything, just the login form. After the first attempt things are fine, though. This is in FF 15.0 behind a static IP. Is this the same issue? –  notacouch Nov 27 '12 at 22:00
    
It fails on multiple attempts for some people, so probably similar but not the same. –  Richard Frank Nov 28 '12 at 5:08
add comment

4 Answers

up vote 7 down vote accepted

I think this has to do with secure forms being enabled. I've noticed that sometimes when I hit the CP my browser will load a cached version of the page. The problem though is the hidden XID form field will have an expired value so submitting the form causes the POST to be invalid and the page refreshes requiring a second login attempt.

share|improve this answer
    
Eric, do you think turning off secure forms poses any major security issues? –  kgrote Apr 30 '13 at 19:23
    
Depends if you have other mechanisms in place to provide the same protection. For example, you can get lots of the same coverage with Mod Security. but even then, I personally wouldn't do it. Dealing with XIDs expiring is a small price to pay for ensuring a secure site :) –  Eric Lamb May 1 '13 at 23:36
    
"I personally wouldn't do it" - you mean you wouldn't turn off secure forms? –  kgrote May 2 '13 at 15:03
    
No, I wouldn't turn off secure forms. Leave secure forms enabled. –  Eric Lamb May 2 '13 at 18:53
add comment

Typically I've found this to be caused by logging into the same site in multiple environments. For example - widgetsite.com, dev.widgetsite.com, and widgetsite.dev. The cause seems to be ExpressionEngine getting confused by the cookies from one version of the site when accessing another. I've only found two solutions to the problem. The first is to clear cookies as you're already doing. The second is to use a different browser for each version to avoid cookie conflicts.

All of this, of course, only applies if you're referring to an environment like I'm describing. If not then this won't help you.

share|improve this answer
    
Yes I've experienced this as a dev, which is not a problem. More concerned about my clients and admins. Why do you think EE would get 'confused' when cookies are supposed to be independent per-domain? –  Richard Frank Nov 27 '12 at 21:59
    
EE CP cookies do seem to have domain vs. subdomain issues; as Jacob posted, I encounter this issue frequently when using dev.example.com and example.com sites. I resolve it by deleting the exp_sessionid cookies for both domains. –  Sandwich May 6 '13 at 15:06
add comment

The dynamic IP issue was fixed in EE 2.5.0 I believe - but I recently ran into this issue due to the server having an incorrect time set, causing sessions to immediately expire after they were created.

The fix was to have my host set the correct server time.

share|improve this answer
add comment

I've added these config overrides to my master config file and haven't had any issues logging in:

// Cookie Settings
$env_config['cookie_domain']            = $_SERVER['HTTP_HOST'];
$env_config['cookie_path']              = '';
$env_config['cookie_prefix']            = ENV . '_';
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.