We recently upgraded our site to use Drupal 7. Previously we were using Drupal 6. In the testing phase, the Drupal 7 instance was available at ports 8000 and 8443 of the main domain, while Drupal 6 was on the defaults, i.e.:
- Drupal 6: http://www.example.com
- Drupal 6 secure: https://www.example.com (443)
- Drupal 7: http://www.example.com:8000
- Drupal 7 secure: https://www.example.com:8443
That worked fine for the testing phase; we were able to log in to each site and restrict D7 access to our internal network. Once we went live, we switched the ports, i.e.:
- Drupal 6: http://www.example.com:8000
- Drupal 6 secure: https://www.example.com:8443
- Drupal 7: http://www.example.com
- Drupal 7 secure: https://www.example.com (443)
This is working in terms of production traffic, so the new D7 site is working fine. However, when we try to log in on the old D6 site for reference, we're redirected to and logged in on the D7 site. That is, operating to
https://www.example.com:8443/user and logging in results in being directed to
https://www.example.com/user/foo/bar, successfully logged in. Going back to the D6 site (on 8443) shows that we are not logged in there.
I thought it could be related to the cookie domain we were using (
.example.com), which seemed a stretch, but removing that didn't help. I also thought it might be a base URL problem, though we have no base URL configured. The secure pages base URLs are configured with the port numbers.
Does anyone know or have an idea as to why this is happening?
I have a feeling that it's a simple thing I've overlooked in our configuration.
HTTPS is enforced on both sites by the Secure Pages module.
EDIT: we think we narrowed it down to the login form submission. The form appears to be submitted to the main domain, without the port. That's logging us in on the wrong site and preventing us from logging in on the D6 one. Why the form would submit without the port and how to fix it is now the issue.