Random logouts from manager area

I've been experiencing random logouts from the manager area on a Modx installation. I recently upgraded it from 0.9.6 to 1.0.5 hoping it would fix the issue. Unfortunately, the issue still persists.

After reading around, it sounded like it could be a server configuration issue. However, there are many other Modx sites installed on the same server. Could it still be a configuration issue, or is there anything else that could be causing it?

The logouts seem to mostly happen when I tried to navigate to a page in the manager area, or when I try to save changes to any type of element.

Another fix I tried was something like this in my .htaccess file:


I tried a variety of paths, but each time I ended up getting an Internal Server Error on the entire site. So I'm not sure where to go from here or what else to try.

I appreciate any help!

I still haven't had any luck solving this, and I haven't found any new information really.

Is there something I can look for in the phpinfo area of the server that would be causing the issue? I'm pretty thoroughly stumped!

I'm not an expert on problems like this but session_save_path seems like a likely culprit, especially if you're on a shared server.

Many hosts don't allow any php directives in .htaccess at all. I think your best bet might be to ask the host to change the session_save_path in the master php.ini file.

Right now the session.save_path is set to /tmp on the server, is that the issue or is that how it should be? From what I've read, that's what it should be, but I don't know enough about it for sure.

There are many other Modx sites on the same server/hosting account, none of which are having this issue. Could it be that something went bad in the Modx install?

So I tried another repair install, and discovered something interesting.

I'm able to stay logged into the manager area fine in Safari, FireFox, and IE. Just not Google Chrome. I've tried clearing my cache and cookies, with no luck.

I also noticed that even when it brings me back to the login page, it's not actually logging the account out. So is it possible that the account is stuck logged in at too many places? Is there a way to force-logout all users like in Revolution? I tried clearing the site cache, but that didn't do it.

Security -> Flush all Sessions will log everyone out.

Same problem here. Multiple Evo sites on the same server and none respond in this manner save the one (all of a sudden).

Login to manager at www.domain.com/manager/ > click tools, configuration > save configuration > instant redirect to domain.com/manager/ login page.

add www to the url and I'm back in the manager logged in.

The only thing that has changed was the default rewrite rules in htaccess to remove www from the url (instead of prepend it). I've since replaced the htaccess rules with the original modx rules and it still happens. Have also commented them out with the same results.

FYI using 1.0.5 there is no security flush all sessions option. Did you mean tools > remove locks?

EDIT: I put the no-www rules back and now everything works as expected, but only when I hit the manager at domain.com/manager/. If I hit the manager at www.domain.com/manager/ I get the redirect on configuration save to domain.com/manager/ and it leaves the www session logged in. Strange because I thought the htaccess rules were supposed to exclude the manager directory. [ed. note: grabenfub last edited this post 14 years, 8 months ago.]

Quote from: grabenfub at Jan 11, 2012, 10:43 PM

EDIT: I put the no-www rules back and now everything works as expected, but only when I hit the manager at domain.com/manager/. If I hit the manager at www.domain.com/manager/ I get the redirect on configuration save to domain.com/manager/ and it leaves the www session logged in. Strange because I thought the htaccess rules were supposed to exclude the manager directory.

There's a different .htacces for manager, located in manager root. You need to enable it (rename from ht.access) to stop rewriting domain requests in manager subfolder...

@Eoler the one in the manager folder was enabled.

I recently installed revo and hit the same problem. Then I remembered this issue from a long way back in the 0.9 series sometime.

The solution (for me at least) was to never go to the www address during setup.

If I don't set up my htaccess first, and I run setup under www.domain.com, then I try to login at domain.com, I get the refresh problem. If I run setup under domain.com, and set up my htaccess 'before' I run setup, then there are no problems.

I don't know why, but this worked for me.

I don't know if this is related here, but i have experienced a similar problem since i have begun building my first sites on a local server (xampp).
I noticed that when a user tries to log in my site and fails to log in because he made a mistake in his username or password,then i am automatically logged out of the manager!
My modx evolution version is 1.0.6.
xampp version 1.7.3.

My solution? Sleep during the day and work during the night. Fewer users in your site means less chances for you to be forced to log out of the manager