A knowledgeable user had a strange login problem today. Our site is using LoginToboggan.
- User went to directly to a URL requiring login (clicked on a link a in an email), but was not logged in.
- User got 403 page, Access Denied, as expected. I have 403 pages set to go to
- User typed in name and password (or browser had it memorized) and clicked "Log in"
- User went to a 403 page again. This happened repeatedly.
The user tried two other browsers, cleared cookies, etc. Eventually he tried our usual login page, which has a regular login block. That worked fine.
I tried this myself several times, and was able to reproduce it exactly once. I noticed at some point during multiple failures that the URL on the 403 page was not the original URL, but was
/user/logout. It was as if I was sort of half-logged-in or half-logged-out.
Since then I've tried numerous variations on this and haven't been able to duplicate it. For the user, it happens consistently. I went over the user's browser settings and they don't seem to be unusual (he accepts third-party cookies, etc.).
Suggestions welcome as to what else to check for.