11

We have a main site at example.com. Logging into example.com/admin works fine there.

But on a testing site at test.example.com/admin I cannot log into the admin without first deleting all example.com cookies. Then I can log in, but as soon as I log into example.com/admin my next click on the test server kicks me back to the login page.

I don't know if this affects customer logins.

Is there some configuration in the main site or testing site that would solve this problem?

14
  1. On the Admin menu, select System > Configuration. Then in the panel on the left, under General, click Web.
  2. Expand the Session Cookie Management section

In the example.com shop, set the following:

  1. Set the Cookie Domain to example.com (usually this setting would be .example.com with a dot in front, you might try it without in this case).

In the test.example.com shop, set the following:

  1. Set the Cookie domain to .test.example.com on the test-environment. (the "." in front of the domain should be fine here)
  • 2
    Just a note, Step 3 about the . in front of the domain, is important! – B00MER Jun 17 '15 at 9:06
  • Hi Anna. Should the cookie domain be set to ".example.com" in the example.com admin, the test.example.com admin, or both? – Buttle Butkus Jun 17 '15 at 19:30
  • I'd set it as default config (which is your example.com admin I guess). So this means .example.com for all scopes. – Anna Völkl Jun 17 '15 at 19:43
  • @AnnaVölkl I'm not sure here. You understand I have two completely separate magento installations on two different machines, right? One uses example.com, the other test.example.com. They both have their own admins. But you are only telling me to set a domain for one of the admins. Are you saying I should leave the other blank? – Buttle Butkus Jun 26 '15 at 3:48
  • Ah, I see. Indeed I was not aware these are 2 sepereate installations. Does the main shop run with or without www-Domain? You could set the Cookie Domain on the Test to test.example.com and on the main shop to www.example.com then to avoid cookie overlapping. – Anna Völkl Jun 26 '15 at 5:59
9

Anna makes some good points and her answer will work for a lot of people, but not for me, so I'm posting my own answer. Perhaps my problem was much more fundamental than the one she addresses.

My solution was to change my site's domain from example.com to www.example.com. In fact, my research on the internet suggests that the reason sites like Amazon, Google, Ebay, and every other major web destination use the www prefix may be in large part due to the way cookies work. Maybe not.

The default way that a cookie works is that it applies to all subdomains. So if example.com sends you a cookie, then you visit mail.example.com, smile.example.com, or devsite.example.com, then your browser will send that cookie to those sites and those sites will try to use the cookie. But they won't be able to find your session unless they all use a common session folder. And even then, you'd likely have problems because of different database configurations, different application structures, etc.

Making the change involved creating 301 redirects in my root htaccess file, changing the secure/insecure urls in the magento core_config_data database table, changing the site's ServerName in Apache VirtualHosts, and updating DNS / nameserver settings. But it was well worth it.

By making my main site www.example.com, its cookies now would only apply to subdomains thereof, such as mail.www.example.com (and we don't have any such subdomains). Client browsers that get the www.example.com cookie do not send it to devsite.example.com, and the issue is solved. Plus it's really nice to have a www in front of our domain name.

  • 1
    I wish I could give multiple Up Votes for this answer. I am looking for a solution for months and everyone keeps saying about Cookie Path and Cookie Domain, but that will not fix the problem if you don't use www. Thank you!! – Bruno Monteiro Feb 16 '17 at 20:37
  • We already have www in the cookie domain, but it does still fail... – Black May 29 at 8:47
  • What does still fail? – Buttle Butkus May 29 at 15:30
3

You can simply change adminhtml cookie name for subdomains.

Two changes in file app/code/core/Mage/Core/Controller/Varien/Action.php.

In function preDispatch change lines

/** @var $session Mage_Core_Model_Session */
$session = Mage::getSingleton('core/session', array('name' => $this->_sessionNamespace))->start();

to

$namespace = $this->_sessionNamespace.($_SERVER['SERVER_NAME']=='subdomain.example.com'?'_subdomain':'');
/** @var $session Mage_Core_Model_Session */
$session = Mage::getSingleton('core/session', array('name' => $namespace))->start();

In function setRedirectWithCookieCheck change

/** @var $session Mage_Core_Model_Session */
session = Mage::getSingleton('core/session', array('name' => $this->_sessionNamespace));

to

$namespace = $this->_sessionNamespace.($_SERVER['SERVER_NAME']=='subdomain.example.com'?'_subdomain':'');
/** @var $session Mage_Core_Model_Session */
$session = Mage::getSingleton('core/session', array('name' => $namespace));

And after that search for text

Mage::getSingleton('core/session', array('name' => 'adminhtml'));

in all files and replace it with

Mage::getSingleton('core/session', array('name' => 'adminhtml'.($_SERVER['SERVER_NAME']=='subdomain.example.com'?'_subdomain':'')));

if any occurances would be found.

  • 1
    Can you explain in words how your code alters client and server cookie interactions to isolate sessions? – Buttle Butkus Mar 14 '17 at 7:57
  • @ButtleButkus the problem is that example.com/admin sets cookie with name adminhtml for the domain .example.com. When you try to authorize at test.example.com/admin, it tries to do something with the cookie adminhtml for .test.example.com. The problems differ on Magento settings. The main problem is that you cannot modify cookie of the main domain from subdomain. The code above makes Magento to create cookie adminhtml for example.com and cookie adminhtml_subdomain for subdomain.example.com, so they will not mix in any way. Change subdomain to the correct one you use. – maxvgi Mar 15 '17 at 8:36
  • That's good for admin side. But frontend side also should change cookie name in this kind of solution, right? – Buttle Butkus Mar 15 '17 at 10:19
  • @ButtleButkus you are right. Sorry, I did not write this because I did not have such kind of problem. – maxvgi Mar 16 '17 at 11:50
  • It's ok, still useful for some people probably. – Buttle Butkus Mar 16 '17 at 12:44
0

If you are still not able to login to your frontend (customer session cannot be created) because of the cookies issues, then please override the respective core file

Pre 1.8.x. versions - app/code/core/Mage/Customer/Model/session.php

and

from 1.8.x. version app/code/core/Mage/Core/Model/Session/Abstract.php

Comment out the lines pointed out in this thread. This has fixed the issue with customer login on the frontend on pre 1.8.x version store.

https://magento.stackexchange.com/a/34057/695

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.