Login on custom context (subdomains)

• MODx 2.0.8 traditional and Login 1.5.2
• Document with a uncached Login snippet call on a custom context (subdomain as a domain alias)
• Uncached Personalize call with placeholder [[+username]]
• A Resource Group with a few assigned documents
• User Group for members that has "Load only" policy to all context (except mgr)
• Resource Group Access to my Resource Groups (also on all context)

Now if I try to login on the custom context it just redirects to the login page. Also Personalize doesn’t set [[+username]]. Even though the number of logins of this user raises every time.

No difference of with and without the experimental feature contexts=`myCustomContext`

However when I move all documents to the ’web’ context it just works™! So I initially thought it might be a bug, but on IRC splittingred pointed out that the issue is due to my subdomain, which suddenly made sense. That I should try to set session_cookie_domain to `.mydomain.com`

http://rtfm.modx.com/display/revolution20/session_cookie_domain

Note: Testing session_cookie_domain is like playing with the fire

Only set this if you are sure of what you are doing.

So after changing session_cookie_domain to `.mydomain.com` I couldn’t login into the manager on mydomain.com/manager anymore. Luckily www.mydomain.com/manager still worked. After some more unsuccessful test of my login call I decided to go back to default `localhost` (according to the docs). Now I couldn’t login to mgr anyomre at all! So in case you screw up like me, just go phpmyadmin
change session_cookie_domain system setting to empty text then clear core/cache/ .

I’ll run all login on default web context for now.

Did you clear the modx_sessions table? If that doesn’t do it, make sure your local browser session cookies were cleared after changing the session_cookie_domain. This setting affects how sessions are identified, so there is not a lot that can be done other than manually truncating the sessions table when you make such a configuration change.

I did flush the session (in my first tests) while manager was still working. For sharing sessions over:
mydomain.com
www.mydomain.com
subdomain.mydomain.com

what value should the session_cookie_domain theoretically be?

I think that I tested `.mydomain.com`, `mydomain.com`, `.mydomain.com,mydomain.com` but got nervous when manager started to not work anymore.

Thanks for the quick reply.

I hope you are not using .mydomain.com literally, but if you want the same session to be usable across subdomains, it has to have the . preceding your actual domain name. Otherwise, each subdomain, including www., will have a different session from the domain itself and from each other.

Don’t worry, I wasn’t using "mydomain", instead I used my actual domain name.

With dot in the beginning session on no-www wont work i.e. http://foo.ch/manager/ since there is no actual dot. Is `foo.com,.foo.com` suppose to work? or `*foo.com` ?

You cannot have a comma-delimited list of values and the only valid wildcard is using a single dot preceding the domain name to indicate you want the cookie to work across all subdomains. So you choice is let the cookie work across all subdomains of your domain, specify a specific domain (which you can do per Context) for the session to apply to, or leave it blank to use whatever domain was requested by the client. You cannot share PHP session cookies across domains, only across subdomains if you indicate that you want to.

Thanks for clarification.