Login snippet error

24,544 Posts

BobRay Reply #11, 15 years, 1 month ago

The $_SESSION array is tied to the URL the user comes in on. Is there anything going on that might be redirecting the user to a different domain between the login and the Captcha check?

Did I help you? Buy me a beer
Get my Book: MODX:The Official Guide
MODX info for everyone: http://bobsguides.com/modx.html
My MODX Extras
Bob's Guides is now hosted at A2 MODX Hosting

27 Posts

andrewjh Reply #12, 15 years ago

Captcha isn't really the issue, I don't think, since there's only a captcha for the MODx manager login. The repeated login problem is happening to the Web users primarily. They are never permitted to access the manager.

My site also has a separate login interface for the web context, using the Login plugin.

I created a logout link which appears at the very top of my site, on all pages. In the template resources it's referenced as a snippet called:

[[!loginLogout]]

Here's the actual code of the snippet:

<?php
$output = '<a href="[[~94]]">Login</a>';
if (!$modx->user->isAuthenticated('web')) {
    return $output; 
} 
if ($modx->user->isAuthenticated('web')) { 
    $output = '<a href="[[~94]]?service=logout">Logout</a>';
    return $output;
  }

I observed the following behaviour recently:

1. I logged in as a web user using the web context login page.
2. I visited the protected content pages that only web users can see.
3. I then logged out using the site-wide logout link (with the ?service=logout attribute).
4. This redirected me to the login page, which displayed the login form (therefore I was, at least, partially logged out). I then logged in as a different user this time.
5. I revisited the protected content pages, which contain a [[!Profile]] snippet that displays the user's extended profile information. The profile information being displayed belonged to the previous user I was logged in as.
6. I logged out using the logout link.
7. I logged in again as the second user, visited the protected pages, and this time the profile information was correct.

Could it be that the ?service=logout attribute is not properly ending the user sessions?

MODX Staff
10,725 Posts

opengeek Reply #13, 15 years ago

Are you testing this in an isolated browser session? i.e. not in the same browser as you are using to login to the mgr?

Jason Coward
Chief Architect @ MODX
http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek

27 Posts

andrewjh Reply #14, 15 years ago

I've been able to reproduce the error regardless of browser session. In other words, I've used the same browser to login to the mgr and the web contexts, two different browsers for each session with no overlap, and every combination in between. I've tested on Chrome, IE, FF and Safari. It occurs everywhere.

27 Posts

andrewjh Reply #15, 15 years ago

Just tested it again to confirm. The first time I login after clearing my browser cache and cookies seems to work fine. The second time I login (with a different user), it gives me my conditional output for being not authenticated to the web context. It really is an improperly cleared session state... how do I fix that?

MODX Staff
10,725 Posts

opengeek Reply #16, 15 years ago

If you weren't running 2.1.3 already, I'd say this was related to http://bugs.modx.com/issues/4703, but that should be resolved in 2.1.2+.

It seems that your logout is not working for some reason...

Jason Coward
Chief Architect @ MODX
http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek

27 Posts

andrewjh Reply #17, 15 years ago

Is there anything I can do? Is there another way to implement the logout link to guarantee the session is cleared?

MODX Staff
10,725 Posts

opengeek Reply #18, 15 years ago

Are you sure the Snippet calls on your protected pages are non-cacheable? IOW, are you caching the personalized results of the first user to visit the protected page?

Jason Coward
Chief Architect @ MODX
http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek

27 Posts

andrewjh Reply #19, 15 years ago

I don't think that that's the only problem, though. Because in addition to viewing stale profile information, users are occasionally being told they haven't logged IN (even though the login appeared to successfully redirect them to a login-success page, and the above conditionally rendered logout link displayed "Logout" and not "Login", so at least some "web" authentication is working, or working temporarily?).

Here's the code that displays the profile on the protected pages:

[[!Profile]]
<div class="print-hide" style="float: right;"><a href="[[~99]]">Edit Profile</a></div> 
<table class="family-profile" border="0" cellspacing="0" cellpadding="3">
  <tr>
    <td class="row-odd"><strong>Campus:</strong></td>
    <td class="row-odd">[[+schoolCampus]]</td>
    <td class="row-odd"><strong>Home Phone:</strong></td>
    <td class="row-odd">[[+homePhone]]</td>
  </tr>
  <tr>
    <td class="row-even"><strong>Mother's First Name:</strong></td>
    <td class="row-even">[[+motherFirstName]]</td>
    <td class="row-even"><strong>Mother's Last Name:</strong></td>
    <td class="row-even">[[+motherLastName]]</td>
  </tr>
  <tr>
    <td class="row-odd"><strong>Mother's Work Phone:</strong></td>
    <td class="row-odd">[[+motherWorkPhone]]</td>
    <td class="row-odd"><strong>Mother's Email:</strong></td>
    <td class="row-odd">[[+motherEmail]]</td>
  </tr>
  <tr>
    <td class="row-even"><strong>Father's First Name:</strong></td>
    <td class="row-even">[[+fatherFirstName]]</td>
    <td class="row-even"><strong>Father's Last Name:</strong></td>
    <td class="row-even">[[+fatherLastName]]</td>
  </tr>
  <tr>
    <td class="row-odd"><strong>Father's Work Phone:</strong></td>
    <td class="row-odd">[[+fatherWorkPhone]]</td>
    <td class="row-odd"><strong>Father's Email:</strong></td>
    <td class="row-odd">[[+fatherEmail]]</td>
  </tr>
  <tr>
    <td class="row-even"><strong>Address Line 1:</strong></td>
    <td class="row-even">[[+address1]]</td>
    <td class="row-even"><strong>Address Line 2:</strong></td>
    <td class="row-even">[[+address2]]</td>
  </tr>
  <tr>
    <td class="row-odd"><strong>City:</strong></td>
    <td class="row-odd">[[+parentCity]]</td>
    <td class="row-odd"><strong>Postal Code:</strong></td>
    <td class="row-odd">[[+postalCode]]</td>
  </tr>
  <tr>
    <td class="row-even"><strong>Emergency Contact First Name:</strong></td>
    <td class="row-even">[[+emergencyContactFirstName]]</td>
    <td class="row-even"></td>
    <td class="row-even"></td>
  </tr>
  <tr>
    <td class="row-odd"><strong>Emergency Contact Last Name:</strong></td>
    <td class="row-odd">[[+emergencyContactLastName]]</td>
    <td class="row-odd"></td>
    <td class="row-odd"></td>
  </tr>
  <tr>
    <td class="row-even"><strong>Emergency Contact Phone:</strong></td>
    <td class="row-even">[[+emergencyContactPhone]]</td>
    <td class="row-even"></td>
    <td class="row-even"></td>
  </tr>
  <tr>
    <td class="row-odd"><strong>Child 1 First Name:</strong></td>
    <td class="row-odd">[[+child1FirstName]]</td>
    <td class="row-odd"><strong>Child 1 Last Name:</strong></td>
    <td class="row-odd">[[+child1LastName]]</td>
   </tr>
  <tr>
    <td class="row-even"><strong>Child 1 Health Card #:</strong></td>
    <td class="row-even">[[+child1HealthCard]]</td>
    <td class="row-even"><strong>Child 1 Grade/Class:</strong></td>
    <td class="row-even">[[+child1Grade]]</td>
  </tr>
  <tr>
    <td class="row-odd"><strong>Child 1 Medical/Allergies:</strong></td>
    <td class="row-odd">[[+child1MedicalAllergies]]</td>
    <td class="row-odd"> </td>
    <td class="row-odd"> </td>
  </tr>
  [[!conditionalDisplayChildren]]

[ed. note: andrewjh last edited this post 15 years ago.]

27 Posts

andrewjh Reply #20, 15 years ago

You know, I think what's happening is that the session isn't clearing properly, or right away. Like there's a delay or something...

So when I logout, it sort of clears the session, but then I login and it temporarily reverts to the old session. At least long enough for users to find the link to the protected pages and click it. By the time the page has loaded, their session variable has expired and they're getting the "You must be logged in to view this page" message.

Answered Login snippet error