I have an up and running Drupal 6.30 (latest) site, but some users are having problems logging in. This is due to the user having two rows in the sessions table, one for uid 0 and one for their uid (this one appears after logging in). The session for uid 0 should be removed from the database after authentication, but it is not.
Question: How could a user end up with two sessions or why is the uid 0 not removed?
Steps to repeat and further background:
- Truncate sessions table
- Delete all cookies in browser
- Visit site homepage. This gets a new session for uid 0.
- Login Successful login is seen in the watchdog table. uid x appears in the session table. The uid 0 session is not deleted, but I think it should be.
I believe that this causes the browser to send both sessions and Drupal only expects one, so if the uid 0 session is seen by Drupal then the request is seen to be from an anonymous user.
The user is redirected back to the homepage and is presented the login form again and is not logged in. Ironically, the user's name appears in the footer of the homepage as a logged in user.
Additional info: I managed to get some debug info from a user. After logging in the browser also has two sessions. Both have the same SESSxxxxxx name but different values. So it seems the old session is not being destroyed properly.
Full disclosure: I've posted this question on the Drupal Community Forum but haven't had any response after 48h, I hope it's ok to cross post it here.