After migration, impossible to logging from the remote server, error 'You are not authorized to access this page"

Question

(Drupal 8) From my local environment, I haven't any problem about logging with the admin user.

But after a migration from my local to my remote server, when I log with any user (and admin), I'm redirected to the user page (/user/x, x as number) but I get this error message:

You are not authorized to access this page

If I refresh the page, I'm automatically redirected to the user login page. I don't understand why.

From my database, I see the new session when I logging. And the watchdog shows only the used connecting and then the access denied.

$drush wd-show

25136  27/Dec 00:18  access denied   warning   /user/1
25135  27/Dec 00:18  user            notice    Session opened for okli

Someone can help me?

I noticed I haven't any cookies in my browser after logging in. Maybe the issue is this, but I'm not an expert in Drupal login session.

During the migration, I changed the server configuration. Before, the website used a SSL certificate; I removed the certificate (and the website is in http). I don't think, but may the new server configuration is the source of the problem.

UPDATE : my steps and log

1) From the database, I truncate sessions and flood tables

2) I use firefox browser, I empty all registered cookies

3) I open /var/log/apache2/access.log, /var/log/apache2/error.log and /var/log/mysql/error.log with 'tail -f' from shells and I go to the loggin page with firefox (http://xxx.xxx.xxx.xxx)

4) I enter my admin name and password, then I submit my loggin form. I go to the access denied page :

5) My logs files display :

6) My cookie in my browser have this value :

7) My table session have one entry :

Is is normal my cookie value and database entry aren't the same ? How can/must I do for debug the loggin process and, I hope, find where is the bug ?

below, the content of my apache2.conf file :

Mutex file:${APACHE_LOCK_DIR} default

PidFile ${APACHE_PID_FILE}

Timeout 300
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5

User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}

HostnameLookups Off

ErrorLog ${APACHE_LOG_DIR}/error.log

LogLevel debug

IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf

Include ports.conf

    LimitRequestBody 204800
    FileETag None
    <IfModule mod_headers.c>
        Header always append X-Frame-Options SAMEORIGIN
        Header set X-XSS-Protection "1; mode=block"
        Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
    </IfModule>
    RewriteEngine On
    RewriteCond %{THE_REQUEST} !HTTP/1\.1$
    RewriteRule .* - [F]

<Directory />
    Options FollowSymLinks
    AllowOverride None
    Require all denied
</Directory>

<Directory /usr/share>
    AllowOverride None
    Require all granted
</Directory>

<Directory /var/www/>
    Options -FollowSymLinks -Includes -ExecCGI
        AllowOverride None
        Require all granted
</Directory>

AccessFileName .htaccess

<FilesMatch "^\.ht">
    Require all denied
</FilesMatch>

LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

IncludeOptional conf-enabled/*.conf

And my /ect/apache2/sites-enabled/xxx.conf files (there is only one conf file) :

<VirtualHost *:80>

    ServerAdmin webmaster@localhost
    ServerName xxx.xxx.xxx.xxx  
    DocumentRoot /var/www/drupalmaindir

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

        <Directory /var/www/drupalmaindir>
            Options FollowSymLinks
            AllowOverride All
            Require all granted
    </Directory>
</VirtualHost>

My drupal watchdog :

I don't find where is my mistake and why I can't connect to my drupal website... :/

Note: During the migration, I changed the apache website configuration. Before, the website used a ssl certificate (https), now I remove the certificate (and the website is in http).

Answer 1

According to kingfisher64 in "Access denied" "you are not authorized to access this page" error ???

Just in case somebody stumbles over this issue the solution for me was in settings.php. I had copied a website from one domain to another and had not changed the following setting at the bottom of the file.

$cookie_domain = 'newwebsitenamehere.com';

Note: notice how it does not have http:// nor www. so do not put these.

---

Update: OPer commented:

During the migration, I changed the apache website configuration. Before, the website used a ssl certificate (https), now I remove the certificat (and the website is in http).

Also, another thing to look for in settings.php is the $base_url if it is uncommented (does not have a # at the start) make sure it is the correct domain name (assuming you already pointed your domain name to this new server. If this server does not have a domain name pointing to it, then comment this line out) and also remove the s if it has https:// (since you are not using SSL).

Ex:

OR since there is no SSL, you could just comment it out, by adding a #.