1

I have a Drupal 7 website on the domain hiddendomain.be:3200. Users visiting publicdomain.be are proxied to the hidden domain. My home page is rendered just fine, but when I log in with the existing account TestUser, I get a "You don't have access rights to this page" message. It seems that Drupal still handles the user as anonymous, because going to publicdomain.be/user immediately afterwards returns the login form again. However, in the log report, a new session has been created for TestUser. Why does this happen?

I have been browsing the web for answers, but the only thing I found was to edit the settings.php file in the default directory (in my case that is settings.local.php) by adding

$conf['reverse_proxy'] = TRUE;
$conf['reverse_proxy_addresses'] = array('IP');

where IP is the IP address of the publicdomain.be server. Unfortunately, this does not work. What am I doing wrong?

  • 2
    Maybe it has to do with how Drupal uses the website domain with its cookies. After you log in, Drupal gives a cookie to the browser to use for future requests. Drupal associates the cookie with the site's domain, which it thinks is hiddendomain.be. However, the browser is sending requests to publicdomain.be. This discrepancy is what may be causing the problem. Try setting Drupal's cookie domain to your proxy's domain. In settings.php add the following line: $cookie_domain='publicdomain.be'; – runswithscissors Dec 20 '19 at 5:19
  • 1
    By the way, if your public and private domains share a root, then you can set the cookie_domain to the root instead. For example, if the public domain was www.example.com, and the private domain was private.example.com, then in settings.php you would have $cookie_domain='.example.com'; (note that there is a dot before the domain). – runswithscissors Dec 20 '19 at 5:34
  • 2
    @runswithscissors: Thank you for your suggestions! I changed the cookie domain and the base URL in my settings.php file and now everything works as expected. Please convert your comments to an answer such that I can accept it. – Jeroen Dec 23 '19 at 13:09
3

The problem has to do with how cookies are associated with domains. After you log into a Drupal site, Drupal sends a cookie to the browser that it uses in future requests to show it has been authenticated. Drupal associates that cookie with the domain that the login occurred on. Since your proxy sends requests to your Drupal site using the hiddendomain.be domain, that is the domain that Drupal associates the cookie with. However, the visitor's browser sends requests to publicdomain.be, and so considers the cookie it received from your Drupal site to belong to that domain. It is this discrepancy that is causing the problem.

To fix this, you need to configure Drupal to associate its cookies with the publicdomain.be domain. In your settings.php add, or update, the following line: $cookie_domain='publicdomain.be';

If your public and private domains share a root, then you can use the domain root as the cookie_domain. For example, if the public domain was www.example.com, and the private domain was private.example.com, then in settings.php you would have $cookie_domain='.example.com'; (note that there is a dot before the domain).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.