I was running through some tests on my site with a client, and I was logged in as a normal authenticated user. I then logged out with the intention of logging back in as the superadmin (uid -> 1).

I navigated to a node page where there was a login form, and the site automatically logged me in as the authenticated user that I was logged in as previously.

Do you have any ideas of what could be causing this? The page that where this auto-login occurred reads off of a custom node.tpl file and I've got a few user_load() calls in that code.

  • Have you checked that cookies are being cleared?
    – cam8001
    Sep 25, 2011 at 15:12
  • Could you be more specific about your setup? Could you using any 3rd party modules or rules that you forgot about? Jan 23, 2012 at 5:35
  • curious..have you been successful in reproducing this problem? Mar 23, 2012 at 6:47

5 Answers 5


If you are also using the global $user object in your code, doing something like $user=user_load($node->uid) can 'log you in'. This is a security issue and should be corrected.


It sounds like you have a global $user object that you are then overwriting.

The problem code would look something like:

global $user;
$user = user_load($new_user_id);

Search though all of your code for any occurrences of user_load() to locate the problem line.

For safety I usually use copy the global $user to an $account object so I can be user nothing will change the global $user.

For example:

global $user;
$account = $user;

// Do stuff with $account safe in the knowledge that even if I 
// accidentally change it it won't effect the global $user object

I would advise to check caching settings. If you have multiple user_load() calls in page.tpl, and still get previous version of the page, that's a sign of page.tpl not being called at all. So, first of all, check that you don't have aggressive caching/wrong boost settings

  • Well I know that the page.tpl is being called because the $content variable (which displays the node content) in page.tpl along with regions etc. displays the page that I'm viewing. I have drupal's general cache settings set to normal. I wouldn't expect the general cache settings to effect the user sessions like that...
    – user2014
    Aug 25, 2011 at 16:37

Are you using some browser plugin to store login information like Lastpass? Maybe it automatically sign you in everytime you are trying to access the login page. Did you clear your browser cookies? I was in the same problem before but I found out that my plugin(Lastpass) was the root cause of my problem. Try to browse in incognito or use other browser.


Something like this has happened to me before. There was a case of checking whether the current user is the admin. Instead of checking of equality

    // put code here

I did assignement

    // put code here
  • you should use '===' instead of '==' in such an important if statement.
    – saadlulu
    Mar 14, 2013 at 6:50
  • @saadlulu not need '===' !!!
    – Yuseferi
    Feb 18, 2014 at 7:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.