1

I have two Magento 1.9.0.1 sites. One on example.com and one on dev.example.com

Production:

Cookie Path: (none)

Cookie Domain: example.com

Development:

Cookie Path: /

Cookie Domain: dev.example.com

I've cleared the /var/session/ directory from the development site, cleared the /var/cache/ directory, and removed any any all *.example.com cookies from my browser. As soon as I hit the homepage of the development site I get new cookies for both example.com and dev.example.com

The problem is that this is causing the famous "Can't login on the frontend" bug. Magento is seeing both cookies and cookies it should be reading.

Things I've tried to do to debug:

  1. Checked Default vs Website vs Store settings. The development server always has dev.example.com for it's settings, while the production server always has example.com
  2. Checked the frontend for iframes or other content loading example.com from dev.example.com Chrome Inspector shows nothing loading the production domain from the development site.
  3. I've also checked the usual stuff, like making sure that the form_key is present, etc. This is definitely an issue of Magento creating a session/cookie using the wrong domain name.
Improve this question

1 Answer 1

Reset to default
1

Using .example.com as a cookie domain means it'll take any cookie that contains .example.com in the domain. The only way to fix this would be to also specify a subdomain for the live webshop. For example; user .www.example.com as the cookie domain.

Improve this answer
4
  • 1
    My understanding is that only .example.com (with the leading dot) would match all subdomains. If I leave the leading dot out of my settings on production, (as I have done,) shouldn't this only match the literal example.com?
    – Tyler V.
    Sep 15, 2015 at 20:58
  • As far as I know without a leading . can only be accomplished by setting a cookie directly with header(). PHPs cookie method always prefixes the domain with a dot
    – Sander Mangel ♦
    Sep 15, 2015 at 21:15
  • This doesn't explain the following: Clear ALL cookies having to do with example.com and any of it's subdomains. Then, visit dev.example.com and note in Chrome that a new cookie has been created for example.com and dev.example.com. It shouldn't create cookies for two domains, should it?
    – Tyler V.
    Sep 15, 2015 at 22:30
  • @TylerV. hmmm you got me there. That's weird indeed
    – Sander Mangel ♦
    Sep 16, 2015 at 6:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.