Getting logged out all the time

Question

This has been happening since first started using drupal a year ago and I see others having same problem with no real answer beyond cache.

If you reload it will log you back in but that is no good for users, they will just be confused and frustrated by it and it would seem stupid to put a warning "please keep refreshing your page if you are logged out".

I remember at one stage being told you need to decide between www or no www to stop this from happening but that never really worked, only sometimes.

There must be a logical explanation and definitive way to stop it, surely?

Answer 1

The www is not part of your domain name. It is a web server configuration setting that some servers use and some do not. By default a web server will show your website at both www.mywebsite.com and mywebsite.com.

The sites with www and without www are also cached differently in a browser.

Your current problem can be resolved through the following.

Find the following code in your .htaccess file and remove # hash sign from the last two lines.

  # To redirect all users to access the site WITHOUT the 'www.' prefix,
  # (http://www.example.com/... will be redirected to http://example.com/...)
  # uncomment the following:
  # RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
  # RewriteRule ^ http%{ENV:protossl}://%1%{REQUEST_URI} [L,R=301]

If you prefer to use www site with www. prefix you may use the following instead.

  # To redirect all users to access the site WITH the 'www.' prefix,
  # (http://example.com/... will be redirected to http://www.example.com/...)
  # uncomment the following:
  # RewriteCond %{HTTP_HOST} .
  # RewriteCond %{HTTP_HOST} !^www\. [NC]
  # RewriteRule ^ http%{ENV:protossl}://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Answer 2

I would imagine that if your users can just refresh the page to become logged back in, that they're almost certainly not being logged out in the first place. Far more likely that they're being served a cached version of the page.

Consider this situation:

1. User visits home page as an unauthenticated user
2. Cache headers tell the browser to keep that page for at least x minutes before refreshing
3. User visits the login page and authenticates.
4. User re-visits the home page
5. The browser cache kicks in, and the user is shown the cached version of the home page they saw the first time round
6. User refreshes the page - the browser cache is cleared, and they now see the index page as an auth'd user

There must be a logical explanation and definitive way to stop it, surely?

Absolutely there will be - but you need to identify which part of your setup is responsible for the problem. As described above, it's probably a caching issue, so that's where you debugging should concentrate. I've seen this sort of behaviour more often when a reverse proxy is in front of Drupal, so if you have one enabled, start debugging that first.

If you're not comfortable debugging caching issues in that manner, you'll really need to hire someone who is to do the job. It's not something you can do half-heartedly, or without a reasonable knowledge of caching in general (not just in Drupal). If you happen to have a Pantheon account, ask them about it - they plugged the same bug in their Varnish config some time back (I have no idea how though, didn't ask).

I'm not sure that any more specific advice can be really be given, without having access to the server. I'm by no means a caching ninja though, so maybe someone else will be able to offer a specific part of config you can change, test you can do, etc.

Answer 3

Switching from www.example.com to example.com changes subdomains, and this will cause you to not be logged in on one subdomain if you logged in on the other.

To correct this, you can force the use of one domain name in your apache configuration or .htaccess using rewrites or redirects as previously mentioned, or you can edit your site's settings.php file and uncomment out the line $cookie_domain=".example.com" and it will work regardless of the subdomain.