Intermittent silent login failure

Question

A knowledgeable user had a strange login problem today. Our site is using LoginToboggan.

1. User went to directly to a URL requiring login (clicked on a link a in an email), but was not logged in.
2. User got 403 page, Access Denied, as expected. I have 403 pages set to go to /toboggan/denied.
3. User typed in name and password (or browser had it memorized) and clicked "Log in"
4. User went to a 403 page again. This happened repeatedly.

The user tried two other browsers, cleared cookies, etc. Eventually he tried our usual login page, which has a regular login block. That worked fine.

I tried this myself several times, and was able to reproduce it exactly once. I noticed at some point during multiple failures that the URL on the 403 page was not the original URL, but was /user/logout. It was as if I was sort of half-logged-in or half-logged-out.

Since then I've tried numerous variations on this and haven't been able to duplicate it. For the user, it happens consistently. I went over the user's browser settings and they don't seem to be unusual (he accepts third-party cookies, etc.).

Suggestions welcome as to what else to check for.

Answer 1

I believe this was due to the user logging in as http://example.com and then trying to access a link (from an email) to http://www.example.com/page-that-requires-a-login. In addition the user had a bad browser-memorized password for http://www.example.com, though his password for http://example.com was good. This apparently caused an odd loop of login failures.

I have uncommented the Drupal-supplied redirects in .htaccess that force all http://www.example.com URL's to redirect to http://example.com versions, and have told all my users they may need to re-memorize their passwords in the browser.