6

This has been a continuous issue with ExpressionEngine - admins having to clear their cookies to login to the site.

Even when typing in the correct username and password, the user is return back to the control panel login page with no error message. How do you prevent this?

Improve this question
4
  • Is this a Chrome-only issue? Does changing your session type to be sessions only help?
    – Tyssen
    Commented Nov 27, 2012 at 21:47
  • I've had it across all browsers for about 5 years. My guess it is because we're behind a dynamic IP address, but I'd like to hear some ideas.
    – Richard Frank
    Commented Nov 27, 2012 at 21:50
  • I don't have to clear my cookies, but after having my session timed out for a while the next time I try to login I get no error or anything, just the login form. After the first attempt things are fine, though. This is in FF 15.0 behind a static IP. Is this the same issue?
    – notacouch
    Commented Nov 27, 2012 at 22:00
  • It fails on multiple attempts for some people, so probably similar but not the same.
    – Richard Frank
    Commented Nov 28, 2012 at 5:08

4 Answers 4

Reset to default
7

I think this has to do with secure forms being enabled. I've noticed that sometimes when I hit the CP my browser will load a cached version of the page. The problem though is the hidden XID form field will have an expired value so submitting the form causes the POST to be invalid and the page refreshes requiring a second login attempt.

Improve this answer
4
  • Eric, do you think turning off secure forms poses any major security issues?
    – kmgdev
    Commented Apr 30, 2013 at 19:23
  • Depends if you have other mechanisms in place to provide the same protection. For example, you can get lots of the same coverage with Mod Security. but even then, I personally wouldn't do it. Dealing with XIDs expiring is a small price to pay for ensuring a secure site :)
    – Eric Lamb
    Commented May 1, 2013 at 23:36
  • "I personally wouldn't do it" - you mean you wouldn't turn off secure forms?
    – kmgdev
    Commented May 2, 2013 at 15:03
  • No, I wouldn't turn off secure forms. Leave secure forms enabled.
    – Eric Lamb
    Commented May 2, 2013 at 18:53
7

Typically I've found this to be caused by logging into the same site in multiple environments. For example - widgetsite.com, dev.widgetsite.com, and widgetsite.dev. The cause seems to be ExpressionEngine getting confused by the cookies from one version of the site when accessing another. I've only found two solutions to the problem. The first is to clear cookies as you're already doing. The second is to use a different browser for each version to avoid cookie conflicts.

All of this, of course, only applies if you're referring to an environment like I'm describing. If not then this won't help you.

Improve this answer
2
  • Yes I've experienced this as a dev, which is not a problem. More concerned about my clients and admins. Why do you think EE would get 'confused' when cookies are supposed to be independent per-domain?
    – Richard Frank
    Commented Nov 27, 2012 at 21:59
  • EE CP cookies do seem to have domain vs. subdomain issues; as Jacob posted, I encounter this issue frequently when using dev.example.com and example.com sites. I resolve it by deleting the exp_sessionid cookies for both domains.
    – Sandwich
    Commented May 6, 2013 at 15:06
5

The dynamic IP issue was fixed in EE 2.5.0 I believe - but I recently ran into this issue due to the server having an incorrect time set, causing sessions to immediately expire after they were created.

The fix was to have my host set the correct server time.

Improve this answer
1

I've added these config overrides to my master config file and haven't had any issues logging in:

// Cookie Settings
$env_config['cookie_domain']            = $_SERVER['HTTP_HOST'];
$env_config['cookie_path']              = '';
$env_config['cookie_prefix']            = ENV . '_';
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.