Locked out of the site, and new users can't get in

Question

I have an odd problem. My new Drupal 8 site is a distro, purchased from ThemeForest. After installing it, I thought I created a new user correctly but maybe the name had disallowed characters. In any case, after logging out for the first time, I can't get back in, even when using the browser-stored un/pw or my stored record. I then created a new user in Drush, elevated it to admin, and still can't get in, saying it doesn't recognize the user. I tried applying for new password, but when I try the link, I get this:

Redirects to external URLs are not allowed by default, use \Drupal\Core\Routing\TrustedRedirectResponse for it.

So then I thought, maybe I should have set my trusted domains to fix the error in the Status Report. I then edited my settings php to set my domain as trusted, similar to what I did for another Drupal 8 site that is side-by-side in the same public_html folder.

However, one difference is that the site I'm now locked out of is being redirected by htaccess. I had to do this because my hosting service by default wants to put my primary-domain site in the root of public_html, and I wanted it in a subfolder, just like the other sites. So I created this htaccess rule to point the main domain to a particular folder:

RewriteEngine on
RewriteCond %{HTTP_HOST} ^mydomain.com$ [NC,OR]
RewriteCond %{HTTP_HOST} ^www.mydomain.com$
RewriteCond %{REQUEST_URI} !folderitresidesin/
RewriteRule (.*) /folderwhereitresides/$1 [L]

Those are the most relevant facts I can think of. Now the question is: does this htaccess redirect affect login? Do I need to do anything to make sure Drupal understands this htaccess redirect? Or is it something else?

I've looked into the "Drupal\Core\Routing\TrustedRedirectResponse" message but that seems to b aimed at redirecting to external urls. I don't see how that applies to me.

Thanks in advance to any good samaritan who can help!

Answer 1

For a while it seemed that adding localhost to the Trusted Host settings in settings php did some good, then I realized it didn't so I removed it, leaving just the lines below:

$settings['container_yamls'][] = $app_root . '/' . $site_path . '/services.yml';
$settings['trusted_host_patterns'] = array(
'^mydomain\.com$',
'^.+\.mydomain\.com$',
);

I think the Trusted Host settings is critical for several reasons. But then out of the blue I somehow found I can enter the site by logging into

mysite/user/login

Even though it throws the error page with this message:

Redirects to external URLs are not allowed by default, use \Drupal\Core\Routing\TrustedRedirectResponse for it.

However I'm actually logged in. All I have to do is append the site folder name to the path then I'm in.

http://www.mysiteurl/sitefolder/

In fact, I can just log in by going to

http://www.mysiteurl/sitefolder/user/login

The sitefolder added to the URL seems to be an alternate url for the entire site. I don't know if that will cause a problem but at least most of my problems are solved for now.

I hope this helps somebody. It seems to result from shared hosting not letting me install my primary site to a subfolder in public_html without making a fancy adjustment in htaccess.