How to Fix Magento Login Issues with Cookies and Sessions
This article was created in partnership with Ktree. Thank you for supporting the partners who make SitePoint possible.
In this article are looking at how Magento cookies can create issues with the login functionality of both the customer-facing front-end and admin back-end, the reason it occurs and how it should be resolved.
This is also known as the looping issue, as the screen redirects itself to the same screen, even though the username and password is correct.
A script is provided at the end of the article which can help detect a few of the issues. Feel free to use and modify as per your needs.
What is a Cookie?
A cookie is a piece of text that a web server can store on a user's hard drive, and can also later retrieve it. Magento uses cookies in Cart & Backend Admin functionalities, and they may be the source of a few problems when unable to login to Magento.
What is a Session?
A session is an array variable on the server side, which stores information to be used across multiple pages. For example, items added to the cart are typically saved in sessions, and when the user browses the checkout page they are read from the session.
Sessions are identified by a unique ID. Its name changes depemnding on the programming language — in PHP it is called a 'PHP Session ID'. As you might have guessed, the same PHP Session ID needs to be stored as a cookie in the client browser to relate.
Magento's storage of Sessions
Magento can store sessions via multiple session providers and this can be configured in the Magento config file at app/etc/local.xml. These session providers can be chosen here.
File
<session_save><![CDATA[files]]></session_save>
<session_save_path>
<![CDATA[/tmp/session]]>
</session_save_path>
Database
Allowing sessions to store themselves in the database is done in /app/etc/local.xml by adding <session_save><![CDATA[db]]></session_save>.
Magento applications store sessions in the Core\_session table.
Redis
<session_save>db</session_save>
<redis_session>
<host>127.0.0.1</host>
<port>6379</port>
</redis_session>
MemCache
session_save><![CDATA[memcache]]></session_save>
<session_save_path>
<![CDATA[tcp://localhost:11211?persistent=1&weight=2&timeout=10&retry_interval=10]]>
</session_save_path>
Magento Usage
Magento uses two different cookies named 'frontend' and 'adminhtml'. The first one is created when any page is browsed. The same cookie is also updated whenever the customer logs in, and the next one is created when a backend user is logged in. You can check whether the cookies have been created by clicking Inspect Element > Application, as in the below picture (from Chrome):
Cookies are configured in Magento via the Configuration admin menu - System > Configuration > General > Web.
Problem: Login Fails & Redirects to Login Page
If you haven't experienced this problem, then you haven't worked with Magento long enough!
This is how it typically happens: when you login by entering your username and password, you will be redirected to the same login page and URL, and your browser is appended with nonce id. This happens for both the customer front-end and the Magento back-end login.
Let's look at a few reasons why this happens, and how we should resolve those issues.
Reason #1: Cookie domain does not match server domain
Let's say your Magento site is example.com and the cookie domain in Magento is configured as xyz.com.
In this scenario both Magento cookies will set Domain Value as xyz.com, but for validating the session Magento will consider the domain through which the site was accessed — in this case example.com. Since it won't be able to find an active session with the example.com domain value, it will redirect the user to the login page even when valid credentials are provided.
app/code/core/Mage/Core/Model/Session/Abstract.php
After login or logout, the Magento system will regenerate the session using the following script:
public function renewSession()
{
$this->getCookie()->delete($this->getSessionName());
$this->regenerateSessionId();
$sessionHosts = $this->getSessionHosts();
$currentCookieDomain = $this->getCookie()->getDomain();
if (is_array($sessionHosts)) {
foreach (array_keys($sessionHosts) as $host) {
// Delete cookies with the same name for parent domains
if (strpos($currentCookieDomain, $host) > 0) {
$this->getCookie()->delete($this->getSessionName(), null, $host);
}
}
}
return $this;
}
app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
Magento will validate the session for every request with the following method:
public function init($namespace, $sessionName=null)
{
if (!isset($_SESSION)) {
$this->start($sessionName);
}
if (!isset($_SESSION[$namespace])) {
$_SESSION[$namespace] = array();
}
$this->_data = &$_SESSION[$namespace];
$this->validate();
$this->revalidateCookie();
return $this;
}
You may normally see this when you migrate your Magento instance from one domain to another domain, for example from Production to Staging, and forget to change the cookie domain.
Note: you can run the provided cookieTest.php script, which validates what the server cookie domain is, and what is set in the Magento config.
Solution:
Change the Cookie Domain via the Configuration admin menu. Go to System > Configuration > General > Web, as per the screenshot.
Alternatively you can change this by running these SQL queries.
For validating the cookie domain use this select query to get the configuration:
SELECT * FROM core_config_data WHERE path = 'web/cookie/cookie_domain';
After executing this query, we will get the results. Verify the 'value' column is the same as your domain. Update the value if it is not the same as your domain.
To update the cookie domain, use this query:
UPDATE core_config_data SET VALUE = "domain.com" WHERE path = 'web/cookie/cookie_domain';
Reason #2: Multiple subdomains used and Magento's cookie configuration is incorrect
Let's say your site is example.com. Logging into example.com/admin works fine.
But on your staging/QA site, for example staging.example.com/admin, you are unable to login without deleting all cookies. The system may allow logins to staging.example.com, but when we login again to example.com/admin, your next click on staging.example.com kicks you back to the login page. Similar behavior is experienced for customers using the front-end login as well.
Solution 1
Option A: If your main domain and subdomains are hosted on the same server
Continue reading %How to Fix Magento Login Issues with Cookies and Sessions%