ssl login problems

Hi

Since installing an ssl certificate, login problems are being reported by a significant number of users.

It appears that when they log in, they're returned to the login page with an 'access denied' message - yet they have been logged in (if they go to a different page, links are displayed that only show when logged in). For most users, just pressing the login button again gets them to where they should be.

Any help much appreciated, as ever.
Cheers
Chris

Do you have a url and steps to reproduce? I need to see a problem in order to fix it.

Hi Ray

many thanks - details in pm

It looks like it works if you use:
https://yourdomain.org

but won't if you use:
https://www.yourdomain.org

A good solution might be to use your .htaccess file to force the non-www version of the site.

#Force non-www:
RewriteEngine on
RewriteCond %{HTTP_HOST} ^www\.example\.com [NC]
RewriteRule ^(.*)$ http://example.com/$1 [L,R=301]

Hi Ray

Just tried no www. version and exactly the same results.

After you logout, then go to the login page again, you're straight in

Chris

I can't seem to reproduce the problem. I log in and go to the members home page every time. Are there any steps I might be missing?

Once logged in successfully, when you log out then log in again, it works first time - every time! However, after closing the browser window and returning to the login page, the issue recurs.

Definitely weird!

Cheers
Chris

I tried a new browser session, even tried a new browser, and the login worked for me.

What are the exact steps? Maybe I'm doing something different.

Hi Ray

That appears to be the issue - it works for me too, most times!

However, I have modified the page for those who have problems.

Now, it appears that sessions aren't being killed after logout!

Cheers
Chris

Hi Ray

I think I have the login page working properly, but there is definitely a WEIRD issue on logout!

Click the logout link, all sessions are apparently killed. However, going 'back' in the browser, you can still access the page.

So I created a page to show all session values; logout, then go to this page and it shows there are none - however, the 'back' button still gives access. \moreover, if i go to the login page, the links are still displayed to the admin areas - these should only be displayed if Session values are available.

I'm stumped!

Cheers
Chris