Magento customer login and admin login session/cookie issue

Question

I know this questions asked many times but solutions were used for some people not all. I am running Magento 1.9.2.4 community version. We are facing an issue like whenever the customer tries to log in, it's redirecting to the same page. This same issue happening for admin login also. If I do it in incognito mode in the browser then some time works but not all the time.

I have tried with following settings,

• Our main domain is, for example, is mydomain.com and we are running different subdomain like abc.mydomain.com bcd.mydomain.com etc. I did below settings for my all domains with respective domain names but it not helped.

• Setting cookie domain and path in admin backend at System > Configuration > Web > Cookie and Session Management

  Cookie Life Time: 3600 Cookie Path: / Cookie Domain : abc.mydomain.com Use HTTP Only : YES Cookie Restriction Mode: No

• My session storage option is file system

• Clearing browser cookies all the time to just login is not working out.

• when I see the view page source for my webpage I got following code which is set by Magento default

  Mage.Cookies.path     = '/';
  Mage.Cookies.domain   = '.abc.mydomain.com';
  

  why magento setting domain name is ".abc.homestudio.com" because we have set in backend domain name as "abc.mydomain.com"?

I'd very much appreciate some feedback.

Answer 1

You need to force Magento to use the same cookie domain in all cases. This solution was tested on Magento 1.9.2.4

When the Session Cookie Management variables are not set incorrectly Magento may create two "frontend" cookies with different cookie domains. This typically happens during the login process when you have HTTPS/SSL in the secure URL. Here are workable values for the Session cookie management configuration.

Cookie Life Time: 3600
Cookie Path: /
Cookie Domain : .mydomain.com (The dot prefix is important)
Use HTTP Only : No
Cookie Restriction Mode: No 

1. In the admin panel go to System -> Configuration -> Web-> Session Cookie Management
2. Set the Cookie Management configuration as shown above
3. Save the configuration and clear the magento cache
4. Restart your web server to clear the PHP variables in case you made the change directly in MYSQL database
5. Clear your browser cache to remove any existing cookies associated with your magento site

Using the dot prefix on the cookie domain is important to prevent duplicate cookies from being created for the secure URL

You can inspect your sites cookies using the developer tools in the FireFox or chrome browser.

Changing the cookie domain will also affect the adminhtml cookie used by the back end. Make sure to clear your browser cache to prevent admin login problems.