It doesn't look like the code checking the cookie domain is consistent with the domain actually used by Drupal for its cookies. It should logically use the global $cookie_domain which is setup very early in the bootstrap by conf_init()(drupal_settings_initialize() in D7).

Comments

nedjo’s picture

nedjo
he/him/his
Primary language English
commented

Patch very welcome. Taking over module even more welcome!

Apparently the overall approach doesn't work with D7, see #2946-114: Login fails and no warning is issued if cookies are not enabled.

neclimdul’s picture

neclimdul
He/Him
commented

Not surprised, when I try to login with pressflow it blows up because of the lazy cookie addition. I'm sure D7 has the same problem.

Wanted to make sure I created an issue while I was looking at it. I'll see about a patch and maybe see about maybe trying some other approaches since I have recently run into a lot of users not having cookies enabled(who blocks cookies in 2011?!?)