Problem/Motivation

Frontend logins sporadically fail. Here's an example of a response I received after logging in on frontend:

403 error

Set-Cookie header on redirect response (from fe to be domain) is missing domain parameter and session cookie is not stored by the browser.

It usually works on fresh environment set up but after first login it usually fails for me.

This is a followup of #3336148: Add support for drupal forms in the frontend.

Steps to reproduce

Needs more testing and investigation.

Remaining tasks

  • Determine the root cause of failed logins. (Check if frontend pre-caches anything).
  • Check if setting domain parameter to Set-Cookie header resolves the issue.
CommentFileSizeAuthor
sc-240930-1748.png161.64 KBuseernamee

Comments

useernamee created an issue. See original summary.

glynster’s picture

glynster commented

I can't confirm this, but I suspect it might be a configuration issue.

Have you set up your services correctly?

parameters:
  session.storage.options:
    cookie_domain: '.ddev.site'
    cookie_domain_bc_mode: true

This ensures the cookie is shared across all subdomains. Make sure both the front-end and back-end are using the same domain, differentiated only by a subdomain.

glynster’s picture

glynster commented

I can get this response if I try user/logout (if I am logged in). What we currently have setup is a absolute url such as https://test-drupal.ddev.site/user/logout -> https://test-drupal.ddev.site/user/logout/confirm?check_logged_in=1. This redirects the user to Drupal backend for confirmation. That works without issue using the Drupal process.

fago’s picture

fago
Primary language German
Location Vienna
commented
Title: Frontend only logins » Frontend only logins sometimes fail
fago’s picture

fago
Primary language German
Location Vienna
commented
Status: Active » Postponed (maintainer needs more info)

I was trying to to test this, but actually failed logging out.

I figured there is an issue with logouts. It used to work before, so probably https://www.drupal.org/node/2822514 caused it.

When the logout is not working, you stay logged in, and the /user/login route shows access denied. Maybe this is what is happening here?
Please try to reproduce with the gitpod online demo and provide reproduction steps.

fago’s picture

fago
Primary language German
Location Vienna
commented

created #3482348: Add support for user confirmation form of 10.3+ for the logout issue