0

I've just enabled Varnish on a site using the Turpentine extension. Everything's fine except I have a login form in the header.

If I use this form on a unsecure page, then it redirects me to the normal login page. If I use this form on a secure page, it works as expected and the customer is logged in.

Everything was working fine before I enabled Varnish.

The login form has the action "https://..../customer/account/loginPost/"

Any ideas what I can change to get this to work?

Improve this question
2
  • so your login block is cached or not redirects, or you can not login or what?
    – user2857
    Dec 29 '14 at 10:32
  • Are you using anything like pound infront of Varnish to have it cache secure pages as well? What does the request return, Varnish hit/miss, is there a redirect? Need more details...
    – Jonathan Hussey
    Dec 29 '14 at 12:18
1

Is Varnish enabled for https? Probably related to form_key session variable being cached thus failing CSRF check which was added in Magento 1.8.1.0.

Improve this answer
1
  • In the end this was the closest answer I could find. It was specific to the site
    – John Tranter
    Feb 4 '15 at 3:31
0

Seems like an error of ssl certificates, Reomove the https and use only http. Does your site have ssl certificate ?

Improve this answer
1
  • Hello, yes it does have a valid SSL certificate. Everything was working until Varnish was enabled.
    – John Tranter
    Dec 29 '14 at 5:53
-1

This sounds like it could be a form_key issue. Basically the login form has a hidden form_key input which is generated each time a page is loaded. As you are varnishing the content on your insecure pages the form key is no longer being generated, its just a static value that has been cached.

To get around this problem you can "punch holes" in varnish so that the login form isn't cached. This is usually done by either loading dynamic content in with an ajax request post page load and injecting it into the page, or by using varnish Edge Side Includes. I don't use Turpintine so cannot tell you how to configure it, but it looks like it supports both of these options.

Improve this answer
1
  • This is a poor quality answer. You should explain a bit the hole punching idea.
    – Marius ♦
    Dec 29 '14 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.