By rightchristians on

I set up a Drupal application in a subdomain of my main site. Once it was working, I moved the files, changed the conf.php file and moved it to the main domain. All went well except that a there seems to be a problem setting cookies.

Does Drupal set permanent user cookies so they don't have to login? Surely the answer is yes. What setting do I need to change or file do I need to edit to correct this problem.

Comments

Sage-1’s picture

Sage-1 commented

I would also like to know the answer to this -- is there any way to make Drupal set a temporary cookie rather than a permanent one? I would prefer that the user have to log back into my site once he has closed and reopened his browser.

Sage-1’s picture

Sage-1 commented

I can't find any option for this in the administrative controls, nor in the configuration files. Is there something I can edit that will keep cookies from being permanently stored?

frjo’s picture

frjo commented

I have this problem with both Drupal 4.3.x and 4.4.x on two different sites. Users have to log in again almost every time they visit. If a user leave the site for some time, they must many times log in again, if they quit the browser they must always log in again.

For a "normal" user that means that they will not bother to log in unless they really need to. For a small site like the ones I run that is never.

Drupal is a dream to use and develop in, everything except this works wonderfully for me. That makes this problem only more annoying/irritating.

I would really like to have a user setting like GeekLogs "Remember Me For 1 hour/1 week/1 year etc.".

Sage-1’s picture

Sage-1 commented

You're having exactly the opposite problem, then. I *want* my users to have to log in every time they visit. I consider that to be more secure. Right now, though, users who logged in previously are remembered, even if they close their browser, and there doesn't seem to be any way to change it.

Anybody got a solution to this?

frjo’s picture

frjo commented

My ISP just upgraded to Apache2 and PHP 4.3.4 and now users are remembered. I can even quit the browser between visits.

P.S. Remember to make the necessary change in .htaccess when you upgrade to Apache2.

robertdouglass’s picture

robertdouglass commented

Since I'm learning about Drupal and PHP, I thought I'd take a look at your question and see if I could help. I started by searching the code for the word cookie. I reference, in the file user.module, line 612. There the PHP method setCookie gets called. The third parameter, expire, is set to null, which basically means that the session should expire when the browser closes. This, however, is quickly disproved by testing. If I clear the cookies from IE, visit this site, log in, close the browser and come back, I'm still logged in. Another force is at play.

Now I search for session_start (I know enough PHP to know this is how you start sessions) and find it logically in the file session.inc, line 5. This is what the PHP documentation says the default max session is set to, in terms of seconds after the session is started: session.gc_maxlifetime "1440"

If you want to change this default, you can do so in your php.ini file. Or you could use session.use_cookies=0 to disable cookies (makes ugly urls). Or you could find the exit point of the script and call session_destroy.

Read more about PHP sessions here http://de.php.net/manual/en/ref.session.php

- Robert Douglass

-----
visit me at www.robshouse.net

Steven’s picture

Steven commented

Maybe you forgot to copy over .htaccess. Files that start with a dot are often hidden. htaccess controls the cookie lifetime, provided that AllowOverride is enabled in Apache.