If the PHP variable session.cookie_secure is on, Advanced Statistics does not increment read counts correctly. This is how I reproduce the problem:

0) In admin/settings/browscap, check “Monitor browsers” (don't know if that really matters).
1) In admin/reports/settings, enable access log and count content views.
2) In admin/reports/settings/advanced, uncheck “Do not log visits from search engines and crawlers” and check “Only allow unique content views to increment a content's view counter”.
3) Clear access log and reset all node counters.
4) Log out and visit a node anonymously from a single IP using the https protocol. Reload the same page several times.
5) Log in again and check the node read count. It should be, correctly, 1.
6) Log out and visit the same node (many times) using the https protocol again and from the same IP.
7) Log in and check the node read count. I would expect it to be still 1, but it has increased and now it's 2.
8) Log out again and visit the same node using the http protocol instead, reloading the same page several times.
9) Log in again. The read count has been incremented many times, not once. This is definitely not ok.

If session.cookie_secure is unset, then the bug in (9) disappears. I have tried the above with a local installation, but similar problems occur in a production site.

There is another problem, but this one occurs even if session.cookie_secure is off, so I do not know what it depends upon. If I check “Do not log visits from search engines and crawlers”, I clear node counters and access logs, then log out and visit a node (even multiple times and from different IPs), when I log in the node has “0 reads”. No matter what, it will always show “0 reads”. If that matters, I'm using PostgreSQL 8.4.4.

Please help me fix at least the first bug! (Disabling session.cookie_secure is not an option for me).

Comments

Dave Reid’s picture

I can't really help with this. I do not have a secure server setup.

pdrake’s picture

@druido, I believe this is expected behavior. Using session.cookie_secure on HTTP connections will create a new session for every HTTP request. session.cookie_secure should only be used when all traffic occurs via HTTPS.

lifepillar’s picture

Yes, thanks. On a second thought, that makes sense.