0

A knowledgeable user had a strange login problem today. Our site is using LoginToboggan.

  1. User went to directly to a URL requiring login (clicked on a link a in an email), but was not logged in.
  2. User got 403 page, Access Denied, as expected. I have 403 pages set to go to /toboggan/denied.
  3. User typed in name and password (or browser had it memorized) and clicked "Log in"
  4. User went to a 403 page again. This happened repeatedly.

The user tried two other browsers, cleared cookies, etc. Eventually he tried our usual login page, which has a regular login block. That worked fine.

I tried this myself several times, and was able to reproduce it exactly once. I noticed at some point during multiple failures that the URL on the 403 page was not the original URL, but was /user/logout. It was as if I was sort of half-logged-in or half-logged-out.

Since then I've tried numerous variations on this and haven't been able to duplicate it. For the user, it happens consistently. I went over the user's browser settings and they don't seem to be unusual (he accepts third-party cookies, etc.).

Suggestions welcome as to what else to check for.

0

I believe this was due to the user logging in as http://example.com and then trying to access a link (from an email) to http://www.example.com/page-that-requires-a-login. In addition the user had a bad browser-memorized password for http://www.example.com, though his password for http://example.com was good. This apparently caused an odd loop of login failures.

I have uncommented the Drupal-supplied redirects in .htaccess that force all http://www.example.com URL's to redirect to http://example.com versions, and have told all my users they may need to re-memorize their passwords in the browser.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.