-1

I have a website with a private area for authenticated users only.

I have some custom routing to control user access and it generally all works fine, however, I have run in to a problem I am not sure how to fix.

My users can create content. When they create a link to another page on the site - say /apage with its internal alias it all works fine. If they insert the entire url however, say https://www.fakesite.com/apage they get redirected to the login page and asked for their credentials.

Obviously it would be ideal if users only entered the internal alias but there are 200 of them and they don't always listen to me...

Is this a simple fix or have I made some error in my routing?


It's happening on links created within the site. I have watched users do it. User are definitely getting booted to log in, once they log in again they can visit the page from that same link and everything is ok for that page, but it is happening for every single page with an full url link.

5
  • Just a guess but is this because you don't force https and the user is on http but then after following the link the link they go to https so their session is no longer valid?
    – Felix Eve
    Oct 20, 2017 at 4:29
  • https is being forced. Or at least it should be.
    – tanbog
    Oct 20, 2017 at 4:30
  • I doubt this is a drupal problem. Another guess, they insert the entire url in a different browser?
    – 4uk4
    Nov 9, 2017 at 17:18
  • It's happening on links created within the site. I have watched users do it. User are definitely getting booted to log in, once they log in again they can visit the page from that same link and everything is ok for that page but it is happening for every single page with an full url link. I am getting a lot of complaints about it and I am at a loss to fix it...
    – tanbog
    Nov 10, 2017 at 0:12
  • Can you elaborate how they're creating links and more about your configuration? How the content looks like? Are you using a field based on the Link module?
    – kenorb
    Nov 14, 2017 at 10:55

2 Answers 2

2
+50

This is probably due to a change in the base URL. For example, you are using www.example.com sometimes and example.com others (without a redirection from one to the other).

The reason you get logged out is that the browser tracks the session with a cookie that is linked to a specific domain. By default Drupal includes the subdomain (www/bare).

D7 Solution

You can fix this by adding this to your settings.php file.

ini_set('session.cookie_domain', '*example.com');

This will tell your browser to allow both www.example.com and example.com.

Alternatively, you can redirect all traffic to one or the other. Drupal's .htaccess file has examples of both of these. You just need to uncomment one.

D8 Solution

The Drupal 8 solution can be found here: https://drupal.stackexchange.com/a/233753/49434

2
  • Hasn't Drupal 8 moved cookie_domain to container parameters?
    – tanbog
    Nov 14, 2017 at 3:37
  • 1
    Indeed it has. I made the assumption that you were on D7. Answer updated with the solution for D8.
    – lukedekker
    Nov 14, 2017 at 19:05
2

The easiest solution to this would be to always process the users input as an internal URL. The module LinkIt may provide that. Additionally, you can try using the custom code from an answer to this question which will convert whatever the user enters to an internal URL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.