When a user tries to log in, but their browser settings are blocking cookies for a Drupal site, they get an "Access Denied" message with a request to log in. This is confusing for the user. I've put forward this feature request as a starting point for , as a minimum, add a warning message when a login fails.

I checked out 5 other systems with my cookies off, three were not very useful
-- digg.com continued without any indication that I was not logged in
-- a vBulletin system and amazon.com both passed around session ids.

These were more relevant
-- google, yahoo and my bank allowed me to try, and then issued the warning after submitting
-- hotmail didn't let me try to log in, it warned me first.

Of all I checked, wordpress was most like drupal. It offered a the uname/pword screen again, asking me if I'd forgotten my password. Nothing like a chance to make a distinction b/t Drupal and Wordpress! I've attached the hotmail and google messages as a starting point.

(Noting this issue about enabling logins with cookie is, er... different.)

CommentFileSizeAuthor
2logins.gif14.2 KBsime

Comments

neclimdul’s picture

neclimdul
He/Him
commented

That'd be a nice easy feature. Here's a link to some info on zend.com about detecting cookies in php.
http://www.zend.com/codex.php?id=8&single=1

Since we always give a session cookie it would make sense that we might be able to work out an elegant solution testing for $_COOKIE['PHPSESSID'].

So there's a bit of early conjuring and research for anyone interested in picking this up.

dww’s picture

dww
we/he/they
commented

i can't work on this myself right now, but this is a long-standing itch of mine. ;) i'd love to see this in core, though i agree this is going to have to wait for 6.x. huge +1 from me in spirit. i'll certainly test/review if someone else provides a patch, and i might even take up the charge myself if i don't see progress and it's getting close to the D6 code freeze... ;)

cheers,
-derek

rstamm’s picture

rstamm commented

I wrote a small module for my sites which displays a message on the login page if cookies are disabled.

Maybe it will be of interest to you, please have a look. http://cvs.drupal.org/viewcvs/drupal/contributions/sandbox/flanker/login...

At the moment it's only in my sandbox but i can create a project of it later.

Ralf

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

This issue actually highlights a more difficult one that we have run into on SavannahNow.com.

We run and allow a number of scripts to interact with our site (including Google's web crawler, a 3rd-party search indexer, and some automated input scripts). These scripts all run with cookies off. The result is that for every page view, a new PHP session is spawned. Since we have a large site, with 200+ pages added per day, our sessions table fills up. Having a large session table is a known issue with Drupal performance.

We're looking for a way to enable a single session for these automated scripts, but are open to other suggestions. For examnple, CURL requests can implement cookie handling. That should work for our scripts, but does nothing for Google and other 3rd-party bots.

Mind you, we're running 4.6, and are still researching changes in 4.7 and 5 that may solve this issue.

bdragon’s picture

bdragon commented
Status: Active » Closed (duplicate)

Marking as duplicate of http://drupal.org/node/137678

dww’s picture

dww
we/he/they
commented

No, this is duplicate with http://drupal.org/node/2946 -- gotta love those open issues with the 4 digit nids, and that's the oldest reported instance of this issue.

bdragon’s picture

bdragon commented

Well, I am a believer in the "Make the issue with the most valuable discussion the master issue" method, but yeah, I suppose a 4 digiter carries a lot of weight...

richard.e.morton’s picture

richard.e.morton commented

Hello Everyone,

I am and was so surprised that this isn't handled, Drupal seems to be so well engineered and although cookies are a standard part of the web these days with the heightened awareness of security more people are turning off cookies or using features that only accept cookies from trusted websites. For a user to know to add a Drupal site to their trusted list we need to provide a message to them indicating the issue.

I would love to see this in core, but a module for D6 would be fine ;-)

Rich

dww’s picture

dww
we/he/they
commented

Commenting here is useless. Please see #2946: Login fails and no warning is issued if cookies are not enabled. Thanks.