We have a main site at example.com. Logging into example.com/admin works fine there.
But on a testing site at test.example.com/admin I cannot log into the admin without first deleting all example.com cookies. Then I can log in, but as soon as I log into example.com/admin my next click on the test server kicks me back to the login page.
I don't know if this affects customer logins.
Is there some configuration in the main site or testing site that would solve this problem?
In the example.com shop, set the following:
In the test.example.com shop, set the following:
example.com admin, the test.example.com admin, or both?
Jun 17, 2015 at 19:30
example.com, the other test.example.com. They both have their own admins. But you are only telling me to set a domain for one of the admins. Are you saying I should leave the other blank?
Jun 26, 2015 at 3:48
test.example.com and on the main shop to www.example.com then to avoid cookie overlapping.
Jun 26, 2015 at 5:59
Anna makes some good points and her answer will work for a lot of people, but not for me, so I'm posting my own answer. Perhaps my problem was much more fundamental than the one she addresses.
My solution was to change my site's domain from example.com to www.example.com. In fact, my research on the internet suggests that the reason sites like Amazon, Google, Ebay, and every other major web destination use the www prefix may be in large part due to the way cookies work. Maybe not.
The default way that a cookie works is that it applies to all subdomains. So if example.com sends you a cookie, then you visit mail.example.com, smile.example.com, or devsite.example.com, then your browser will send that cookie to those sites and those sites will try to use the cookie. But they won't be able to find your session unless they all use a common session folder. And even then, you'd likely have problems because of different database configurations, different application structures, etc.
Making the change involved creating 301 redirects in my root htaccess file, changing the secure/insecure urls in the magento core_config_data database table, changing the site's ServerName in Apache VirtualHosts, and updating DNS / nameserver settings. But it was well worth it.
By making my main site www.example.com, its cookies now would only apply to subdomains thereof, such as mail.www.example.com (and we don't have any such subdomains). Client browsers that get the www.example.com cookie do not send it to devsite.example.com, and the issue is solved. Plus it's really nice to have a www in front of our domain name.
You can simply change adminhtml cookie name for subdomains.
Two changes in file app/code/core/Mage/Core/Controller/Varien/Action.php.
In function preDispatch change lines
/** @var $session Mage_Core_Model_Session */
$session = Mage::getSingleton('core/session', array('name' => $this->_sessionNamespace))->start();
to
$namespace = $this->_sessionNamespace.($_SERVER['SERVER_NAME']=='subdomain.example.com'?'_subdomain':'');
/** @var $session Mage_Core_Model_Session */
$session = Mage::getSingleton('core/session', array('name' => $namespace))->start();
In function setRedirectWithCookieCheck change
/** @var $session Mage_Core_Model_Session */
session = Mage::getSingleton('core/session', array('name' => $this->_sessionNamespace));
to
$namespace = $this->_sessionNamespace.($_SERVER['SERVER_NAME']=='subdomain.example.com'?'_subdomain':'');
/** @var $session Mage_Core_Model_Session */
$session = Mage::getSingleton('core/session', array('name' => $namespace));
And after that search for text
Mage::getSingleton('core/session', array('name' => 'adminhtml'));
in all files and replace it with
Mage::getSingleton('core/session', array('name' => 'adminhtml'.($_SERVER['SERVER_NAME']=='subdomain.example.com'?'_subdomain':'')));
if any occurances would be found.
adminhtml for the domain .example.com. When you try to authorize at test.example.com/admin, it tries to do something with the cookie adminhtml for .test.example.com. The problems differ on Magento settings. The main problem is that you cannot modify cookie of the main domain from subdomain. The code above makes Magento to create cookie adminhtml for example.com and cookie adminhtml_subdomain for subdomain.example.com, so they will not mix in any way. Change subdomain to the correct one you use.
If you are still not able to login to your frontend (customer session cannot be created) because of the cookies issues, then please override the respective core file
Pre 1.8.x. versions - app/code/core/Mage/Customer/Model/session.php
and
from 1.8.x. version app/code/core/Mage/Core/Model/Session/Abstract.php
Comment out the lines pointed out in this thread. This has fixed the issue with customer login on the frontend on pre 1.8.x version store.
