Session Expiration & logout upon save or change resource

Revo 2.2.4-pl

Clicking a new resource dumps back to login.

Saving a resource pulls up a pop up saying the user's session has expired and to provide login details. Two options available - login and logout. (never seen this before)

Moving a resource up in the tree also prompts session expiration pop-up.

This behavior occurred after adding a new super user admin with sudo checked.

DefaultResourceGroup and DefaultUserGroup are installed.

Obviously this is going to be a problem. I have convinced a client to trust me to build the site she wants and this isn't going to work at all.

Error log is below, but I can't make any sense of it. I don't recognize these paths and the packages seem to work just fine, however the client's server is new to me still. This is a development subfolder on an existing site, I believe it's shared hosting.

Php was recently upgraded from 4.9.4 to 5.3.14



[2012-06-21 09:38:30] (ERROR @ /lilomdx/connectors/workspace/packages.php) MODX could not download the file. You must enable allow_url_fopen, cURL or fsockopen to use remote transport packaging.
[2012-06-21 09:38:30] (ERROR @ /lilomdx/connectors/workspace/packages.php) Could not transfer package formit-2.0.3-pl.transport.zip to /hermes/bosweb/web128/b1281/sl.lilo/public_html/lilomdx/core/packages/.
[2012-06-21 09:38:33] (ERROR @ /lilomdx/connectors/workspace/packages.php) MODX could not download the file. You must enable allow_url_fopen, cURL or fsockopen to use remote transport packaging.
[2012-06-21 09:38:33] (ERROR @ /lilomdx/connectors/workspace/packages.php) Could not transfer package tinymce-4.3.2-pl.transport.zip to /hermes/bosweb/web128/b1281/sl.lilo/public_html/lilomdx/core/packages/.

[ed. note: frogabog last edited this post 14 years, 3 months ago.]

Are you doing anything with .htaccess e.g. forcing www vs. http:// or via http/https? Session data is stored with a specific domain, so if you login to the www version of the site and the assets are getting pulled via the http:// version, the session can come back saying "who are you? You must log in!".

I don't think those errors from your log are related. I'd recommend cleaning up your .htaccess files to ensure that your site (and manager) are only available via one variant of the domain.

OK, thank you Everett. I think you're on the right track here but I don't know how this server is forcing the www because there was no .htaccess file till yesterday when I enabled modRewrite and added the .htc type (only) with a new .htaccess file at the root. I guess a call to the host is in order. I don't know how they're forcing www but at the static site, it's indeed forced.

Sometimes there are apache settings upstream that force one variant of the domain. So for your site BOTH http://www.yoursite.com AND http://yoursite.com roll over to http://www.yoursite.com ? Even with .htaccess files disabled (i.e. renamed)? That would be a good sign that something is configured upstream.

I had the host remove the forced www. They wouldn't tell me how it was set, however. So now I've got just the domain name displaying. I sent a ticket asking for http:// back, and their response was that it was set that way already and displays that way for them. umkay... ?

I haven't set anything in the .htaccess that would force either http:// or www. I don't know if I will or not, I see no need to use www other than people's bad habit of writing www in front of every domain name.

I've cleared cookies, browser cache, core/cache, etc., etc. multiple times. Sometimes I can work without being logged out, and other times it's timing me out every couple minutes or whenever I switch a tab.

Any further insight about what I can do to stop this? Very frustrating.

Edit: The host is Start Logic. Not too bad of a host so far, very accommodating and easy to work with for support but also a little mysterious for some things, like this www forcing. I'm used to cPanel, theirs is a custom control panel with a lot of "idiot proof" type settings pages.
[ed. note: frogabog last edited this post 14 years, 3 months ago.]

If you send me a login I can look around. SSH would be ideal. http://fireproofsocks.com/contact/