The scenario:
Manager logs in via an address such as www.website.com/manager. The manger then goes to website.com/manager and notices that they must log in. Manager logs into website.com/manager while still being logged in to www.website.com/manager. Manager then logs out of website.com/manager and notices that the session at www.website.com/manager is still active and valid.
My webhost is dreamhost and the domains work both with and without www. My guess is that modx sees www.website.com and website.com as two different domains and as such, allows the manager to login twice without any issues. The real issue I see with that is when a manager goes to manage content on the front-end. They have to know and thus be educated that when they login via www they must also edit via www.
Is there a way to get around this with the default .htaccess file I’m not seeing?
v 0.9.6.1
friendly urls on
using packaged-default .htaccess file
Any help is greatly appreciated,
Jeremy
There’s another section of the .httaccess file:
# Rewrite www.domain.com -> domain.com -- used with SEO Strict URLs plugin
#RewriteCond %{HTTP_HOST} .
#RewriteCond %{HTTP_HOST} !^example-domain-please-change\.com [NC]
#RewriteRule (.*) http://example-domain-please-change.com/$1 [R=301,L]
#
# or for the opposite domain.com -> www.domain.com use the following
# >>> DO NOT USE BOTH THE ABOVE AND BELOW <<<
#
#RewriteCond %{HTTP_HOST} .
#RewriteCond %{HTTP_HOST} !^www\.example-domain-please-change\.com [NC]
#RewriteRule (.*) http://www.example-domain-please-change.com/$1 [R=301,L]
If you pick one, uncomment it, and edit it to match your domain, it should solve your problem.
Bob
I’ll give that a shot, thanks Bob.
-
☆ A M B ☆
- 24,524 Posts
The only problem with that is that the rewrite engine is turned off for the Manager.
Actually the problem here is a cookie issue, and depends on your PHP configuration. If the cookie domain is not specified it defaults to the domain of the page setting the cookie. So if you log in using the mysite.com domain, then that will be the cookie domain. www.mysite.com will be treated as a different domain and the cookie will not be used for that domain, thus requiring the second login for www.mydomain.com.
If the cookie’s domain paramter is set to ".mydomain.com" then the same cookie will work for all subdomains of mydomain.com, including www.mydomain.com. This can be done with the session_set_cookie_params() function before starting the session.
http://il2.php.net/session-set-cookie-params
Another solution was suggested:
I too ran into the problem of session data being different across the site when "www" was used and not used, so here’s a proposed fix if you cannot easily change your "www" access for your web site. (Note: I used $HTTP_HOST rather than $_SERVER["HTTP_HOST"] and $PHP_SELF just for ease of reading)
if($HTTP_HOST == "myhost.net")
header(’Location: http://www.myhost.net’ . $PHP_SELF);
you can also use:
if($HTTP_HOST == "www.myhost.net")
header(’Location: http://myhost.net’ . $PHP_SELF);
Just throw that in a PHP file and include it at the top of all your PHP pages that are accessed. This way, before sessions are even used in a script, the access path is right. I think it should work out just fine. Hope it helps anyone with similar issues.
Quote from: sottwell at Feb 13, 2008, 12:06 PM
The only problem with that is that the rewrite engine is turned off for the Manager.
Actually the problem here is a cookie issue, and depends on your PHP configuration. If the cookie domain is not specified it defaults to the domain of the page setting the cookie. So if you log in using the mysite.com domain, then that will be the cookie domain. www.mysite.com will be treated as a different domain and the cookie will not be used for that domain, thus requiring the second login for www.mydomain.com.
If the cookie’s domain paramter is set to ".mydomain.com" then the same cookie will work for all subdomains of mydomain.com, including www.mydomain.com. This can be done with the session_set_cookie_params() function before starting the session.
Oops. I knew that but was apparently not awake yet.
Would setting one of these in php.ini do the trick?
session.cookie_path specifies path to set in session_cookie. Defaults to /.
session.cookie_domain specifies domain to set in session_cookie. Default is none at all.
Bob
-
☆ A M B ☆
- 24,524 Posts
Yes, you can set that in the php.ini if you want. The path is fine, it’s the domain that needs to be ".domain.com" to be able to deal with all subdomains as well.
well I haven’t seen any issues yet with Bob’s solution as far as the website goes. Unfortunately, and typical of webhosts, I am not able to edit the php.ini. Also, scottwell, would I need to add those lines to ALL php files for modx? Seems pretty extensive to do that.
what issues will I run into with the rewrite turned off in the manager? Friendly urls seem to still work...
-
☆ A M B ☆
- 24,524 Posts
With rewrite turned off in the manager, the www.domain.com to domain.com rewrite won’t take place for the manager pages.
In manager/includes/config.inc.php on line 73 the session cookie is set, with only the first four parameters. You could simply add the domain to that:
setcookie(session_name(), session_id(), $cookieExpiration, MODX_BASE_URL,".mydomain.com");
scottwell,
Can you give me a "break" scenario within the manager pages with my current configuration (includes bob’s fix). I haven’t been able to get the manager pages to act unexpectedly after changing the .htaccess file. I can log in, go to the address bar, take out the www and it redirects back to www.
Will setting that cookie variable (my lingo is all off here, please forgive) that you suggested only work for the manager pages? Or is that the cookie for all authenticated sessions and as such would solve the problem without having to do the .htaccess rewrite? I apologize for the needed spoonfeeding...
Jeremy
Thanks man...