after upgrading from v2.1.3 to v2.10 i am no longer seeing several cookies including exp_uniqueid, exp_userhash, and exp_memberid. I can only seem to log into the admin CP and not the site anymore.
1
-
ive been combing through the libraries/Session.php and member login functions and i just dont see where some of these cookies are being set anymore. It looks to me like all the userdata is being tied to the session id and no longer being set discretely in EE 2.10. Shouldnt i be seeing a unique_id cookie still?– steveinatorxCommented Jun 18, 2015 at 22:29
Add a comment
|
1 Answer
I'm going to jot down what I have in my bog standard 2.10.1 install, after logging in. My install is fully working.
- PHPSESSID (for finding server session)
- exp_sessionid (for finding your ee session)
- exp_csrf_token (for Form anti-forgery)
- exp_expiration
- exp_last_activity
- exp_last_visit
- exp_perpage
- exp_tracker
I think the 'missing' cookies are actually a good thing! With them MITM attacks and other personal information gathering vectors could be used. I beleive EE now uses a more standard principle of toring your session in the DB, the session vars in your PHP session, and just a couple of reference fields for matching are sent via cookies (noted above).
This method is way more secure, yes we have a couple of nuggets of info but these are de-personalised. i.e. if I visited your machine while you were taking a 'toilet break' I could lift your cookies, they'd tell me when someone was last on the site on your computer, but doesn't tell me anything about what user it was...
Of course we don't have an answer yet as to why your login Is not working. We need to check the basics first (sorry):
Clear Cache, Clear Cookies, Go Private Browsing, authenticate and monitor the cookies sent
Please can you check and let us know your Security Settings (
Admin > Security & Privacy > Security & Sessions)
-
This is the same set of cookies being set on my instance as well. You more or less answered the question i had which is why am i no longer seeing the exp_uniqueid and exp_memberid cookies - they are no longer being set as discrete cookies and this data is now being stored directly in the session. i cant vote up due to my points but will when i am able to Commented Jun 22, 2015 at 19:29
-
Cool, as long as your set :) But did you get your login issue sorted?? You dpn't need to vote up but you can accept as the answer (just below the voting icons you should see a tick to click) if you like. This is the important one (costs no rep) as it shows the question does have an answer attached and helps out anyone else with similar issues.– BlatantCommented Jun 22, 2015 at 21:03