We have an issue on our site where the persistent login module doesn't log users in if the user visits an https page, and we've set up that https page to be redirected back to http. Here's what we found:
- Persistent login detects that the user is anonymous, that the persistent login cookie is present, and that persistent_login_check session variable is not set.
- It then deletes the persistent login cookie.
- It does a full bootstrap, which runs securepages_init, which, if it's on a secure page that's not supposed to be secure, will redirect to a non-secure page.
- On the next page load, persistent login won't log the user in, b/c the persistent login cookie is now gone.
- To fix, we need to not redirect during the full bootstrap after the persistent login cookie is invalidated and before a new user object is loaded.
We decided to fix this by patching secure pages module, instead of persistent login. Patch will be attached. Any thoughts are appreciated.
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | persistent-login-compatibility-mixed-mode-1788432-1.patch | 1.74 KB | djbobbydrake |
Comments
Comment #1
djbobbydrake commentedAttached is the patch.
To test:
1) Log into your site and check the option to stay logged in (via persistent login module).
2) Quit your browser.
3) Restart your browser and visit your homepage using https.
4) Confirm that you are successfully logged in and redirected to http.
Comment #2
JoeMcGuire commentedWorked for me. Thanks!
Comment #3
astonvictor commentedI'm closing it because the issue was created a long time ago without any further steps.
if you still need it then raise a new one.
thanks