Problems with login persistence and sessions

Problems with login persistence and sessions

by Frédéric Demers -
Number of replies: 10
Hello! I'm having a lot of problems making moodle work on two completely different systems, my own and sourceforge.

The issue is one of login persistence and seems to be independent of the browser or server system I use. I can not login, the username and password are accepted, but then I am thrown back to the login page when I try to do anything else. I know the login and passwords are accepted as there is a very specific error message when I type in garbage.

My first system is the Sambar web server on Win ME machine:
Sambar Server 5.2
php 4.1.2 (all php.ini settings as per docs)
MySQL 3.23.51
Windows ME

The second system I tried this on is the sourceforge.net host services:
Apache/1.3.26 (Unix) PHP/4.1.2 on Linux
(all php.ini settings as per docs, although I have no control over that)
MySQL 3.23.36

The install goes fairly well in both cases, all tables are created successfully, settings entered and saved, but I am never able to set an admin password, it skips this steps for some reason.

I had to use phpmyadmin on the moodle database and to change the email address, then get moodle to reset the password and send me a copy via email.

The problems are the same if I use Opera 6.05 or IE 6.0 as browser, and cookies are turned on.

Any ideas why I have so many problems with sessions and logins?

Thanks!
I had similar problems installing gallery (a photo gallery script) once on either system, but I have no problems installing phpbb, a bulletin board software..
Are the login routines different?
Average of ratings: -
In reply to Frédéric Demers

Re: Problems with login persistence and sessions

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
I don't really know what phpBB does - Moodle uses objects stored in server-side sessions.

Thanks for the sourceforge tip - I just installed Moodle there and I'm now seeing the same thing, so I'll do some debugging on this and get back to you.

Similar problems to this crop up now and then, but each time it's been a subtly different cause.
In reply to Martin Dougiamas

Re: Problems with login persistence and sessions

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
Wow, this is a really bizarre thing. I'm playing with my sourceforge test site (which has almost the same setup as moodle.com), and getting behaviour like
  • sometimes sessions work. I can log in, I can create courses, I can edit courses.
  • different session data at different times! For example, I edited my user details from 'Admin User' to 'Martin Dougiamas', saved it, logged out, logged back in. Now I'm sitting on the home page hitting "shift-refresh" in my browser - sometimes it says I'm logged in as Admin user, sometimes "Martin Dougiamas", sometimes "not logged in" ! All my browser caching is switched off.

This isn't a Moodle bug ... it's a session thing ... still working on pinning it down ...
In reply to Martin Dougiamas

Re: Problems with login persistence and sessions

by Frédéric Demers -
Well, welcome to the club!
I had very similar problems when I first started playing with the sourceforge site.
I manage to create a course somehow, so I at least successfully logged in as admin once, but now, it's nearly impossible to log back in.

I have had less success with my own server, and did not manage to log in at all.

Anyway, thanks for you help, it's much appreciated!
In reply to Frédéric Demers

Re: Problems with login persistence and sessions

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
I wish I could say I've solved it, but it really does appear to be a session bug with that particular installation of PHP/Apache. There's no easy way to work around it.

Here is a simple test script that shows the problem:

http://moodle.sourceforge.net/test/

The first time you visit it sets a session cookie and a normal cookie. Keep hitting 'continue' and you'll see that every now and then it loses a session cookie and sets it again. That's the error. You can try this script on your own servers if you like.

Some possible clues:

http://bugs.php.net/bug.php?id=19029
http://bugs.php.net/bug.php?id=17846
http://bugs.php.net/bug.php?id=16890
http://bugs.php.net/bug.php?id=16240

I've reported this to Sourceforge.

Cheers,
Martin
In reply to Martin Dougiamas

Re: Problems with login persistence and sessions

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
Ah, I worked it out smile

The trouble is Sourceforge is a cluster of servers, so the sessions are stored on a random machine.

The fix is to create a directory for sessions, make it world-read/writeable, then put a .htaccess file in the root of moodle containing something like:

php_value session.save_path "/home/groups/m/mo/moodle/sessions"
(or whatever your path is)

Moodle is working great for me now on Sourceforge. Perhaps explicitly setting the sessions path will help on your Windows box too.
In reply to Martin Dougiamas

Re: Problems with login persistence and sessions

by Dick Davies -

Unfortunately my hosting co has disabled .htaccess so I can't do that, Their preferred solution is to use a replacement database based session - I only need to know where to put the function so it will be included in all pages before the headers are set - am I right in assuming I can put it in config.php?? 

 

In reply to Martin Dougiamas

Re: Problems with login persistence and sessions

by Dick Davies -

I'm still looking at how to integrate database sessions. I have some code for mySQL which I could put in "no problem" (inasmuch that any new snippets are!) , but that wouldn't help anyone else.

I notice that the ado library has inbuilt sessions and crypto sessions code - would it be a big job to integrate these?  I don't speak ado'ish - but wouldn't it simply mean changing the basic variables to use the moodle CFG-> variables.

Anybody any input?

 

 

In reply to Dick Davies

Re: Problems with login persistence and sessions

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
I've not got much time to look at it now, but this may help:

http://php.weblogs.com/adodb-sessions

From the looks of it the only thing that needs modification is moodle/lib/setup.php.

I'm intending to revisit ADOdb in some detail for Moodle 1.1, to make use of their new "database dictionary" capability (which will mean Moodle can truly support all databases out of the box, even to create and modify tables). At the same time I'll likely revisit database-based sessions too ... there's a bit more to it than just the hack itself, there might be some issues in switching to this method across the board, but this would certainly fix a whole bunch of little problems at once.
In reply to Martin Dougiamas

Re: Problems with login persistence and sessions

by Jeff Wing -

I am having the same kind of login problems. When you log in it says you are not logged in and takes me back to the login page. At the bottom of the log in page it says that I am logged in, and all of the site content is available.

I tried the session directory fix, created a session dir and added .htaccess. I verified that sessions are being stored in that directory but it doesn't fix the problem. Also turned off secure forms trying to make everything as generic as possible, and don't have any firewall software installed.

Here's where it gets really weird. After browsing several links on the site I get a 404 error, page can't be found. I can close the browser (IE6 or NS7) completely and reopen it and still can't access the site. So then I delete cookies in the browser and everything works again, for awhile...til the 404 error pops up again.

Server Details:
Apache Version -
1.3.27 (Unix)
PHP Version       - 4.3.1
MySQL Version  - 4.0.13

I hope someone can shed some light on this problem....

In reply to Martin Dougiamas

Re: Problems with login persistence and sessions

by khanh luu -

I have experience the same thing with session cookie. I use phptriad, the latest version to setup my server. I think php is 4.1 and mysql is 3.23.

After I have log in, the code at the bottom at the screen stay the same, which mean that it still say "you are not log in". However, if I just click to any link then it changed to "you are login as ....."

Hope this help to define what is the actual problem.