User have to login twice to get logged in - why? :/

[Zola]

Hi,

 

I have an issue with user logins. Basically they hgavce to login twice to get access to the member zone.

I have a form on a page and also a slider login form. Both go to the same place.

 

For some reason I and other users have to log in twice to get access. Can anyone please advise as to why this is happening?  I have tested it in several browsers and the problem remains.

 

Here is the code for the forms:

 

            <form name="login_form" method="post" action="download/log.php?action=login">
              <p>Login:<br /> <input type="text" name="user" autofocus="true" placeholder="Type Here" />
              </p>
            
             <p>Password: <br /><input type="password" name="pwd" placeholder="Type Here" />  </p>
             
              <p class="submit">
                <input type="submit" value="Submit" name="submit" class="submit" />
                </p>
              </form>

 

 

Here is the code from log.php. This file sits in the restricted directory and checks that details match the database before letting entry.

 

<?php session_start(); ?>


<?php

$hostname = "::";
$username = "::";
$password = "::";
$database = "::";

$link = MYSQL_CONNECT($hostname,$username,$password);

mysql_select_db($database); 
?>

<?php

if($_GET['action'] == "login") {
$conn = mysql_connect("::","::","::");
$db = mysql_select_db("dbname");  database name goes in this field.
$name = $_POST['user'];
$ip=$_SERVER['REMOTE_ADDR'];
$var = mysql_real_escape_string($var);
$country = file_get_contents('http://stonito.com/script/geoip/?ip='.$ip);
$q_user = mysql_query("SELECT * FROM customer WHERE username='$name'");

?>

<?php
               $insert_query = ("INSERT INTO login(username, ip, country) VALUES ('$name','$ip','$country');");
               mysql_query($insert_query) or die('Error, insert query failed');

?>



<?php
if(mysql_num_rows($q_user) == 1) {

$query = mysql_query("SELECT * FROM customer WHERE username='$name'");
$data = mysql_fetch_array($query);

if($_POST['pwd'] == $data['password']) {
$_SESSION['name'] = true;
header("Location: http://mydomain.com/download/index.php?un=$name");    // This is the page that you want to open if the user successfully logs in to your website.
exit;
} else {
header("Location: http://mydomain.com/failed_login.php");
exit;
}
}
}

if(!isset($_SESSION['name'])) {
header("Location: http://mydomain.com/support.php");
}
?>

 

 

 

 

Any help would be greatly appreciated.

[PeoMachine]

When you try to login on the first time, you get redirect to where?

[Zola]

Hi,

 

Yes I get sent to the support loing page where the login form is.

[PFMaBiSmAd]

This symptom is typical of redirecting around between url's that have and don't have the www. on them, which causes the session to no longer match the variation of the domain name you happen to be on.

 

You are likely reaching the login form through a link that either does or does not have the www. in it. When the form is submitted it goes to your log in page with the same variation of the domain. When your log in code successfully authenticates the user, you redirect to - http://mydomain.com/download/index.php?un=$name (probably without the www. in the url.) The session check in your code at download/index.php doesn't work and it redirects back to the log in form. However, now the url you are using on the log in form will have the same variation of the url (probably without the www. in it) and the session will carry through to all pages.

 

If this sounds like what is occuring, there are two ways of correcting this -

 

1) You can set the session.cookie_domain to be '.yourdomain.com' (with the leading dot) so that the session id cookie will match all variations of your domain. You must do this before every session_start statement (putting it into a file that you are including on every page before the session_start is generally the surest and most portable solution.)

 

2) You can set up a .htaccess redirect to send all non-www. requests to the corresponding www. variation of your domain.

[downah]

I also had the same problem, make sure your session start is at the top of every page, that seemed to have fixed it for me.

[Zola]

This symptom is typical of redirecting around between url's that have and don't have the www. on them, which causes the session to no longer match the variation of the domain name you happen to be on.

 

You are likely reaching the login form through a link that either does or does not have the www. in it. When the form is submitted it goes to your log in page with the same variation of the domain. When your log in code successfully authenticates the user, you redirect to - http://mydomain.com/download/index.php?un=$name (probably without the www. in the url.) The session check in your code at download/index.php doesn't work and it redirects back to the log in form. However, now the url you are using on the log in form will have the same variation of the url (probably without the www. in it) and the session will carry through to all pages.

 

If this sounds like what is occuring, there are two ways of correcting this -

 

1) You can set the session.cookie_domain to be '.yourdomain.com' (with the leading dot) so that the session id cookie will match all variations of your domain. You must do this before every session_start statement (putting it into a file that you are including on every page before the session_start is generally the surest and most portable solution.)

 

2) You can set up a .htaccess redirect to send all non-www. requests to the corresponding www. variation of your domain.

 

Sorry for the late reply, I have been away for a few days.  Thank you very much for your reply!

 

I changed the log information to redirect to http://www.mysite.com/etc

The issue seems to only crop up if the user has mysite.com in the address bar and not www.mysite.com

 

When the WWW. is in the address bar it seems to work in all browsers... but it takes two attempts when the www. is not there.

 

Can you please explain what you mean when setting session.cookie_domain  ?

 

I am fairly new to php. What would I need to write before my session start call to get this to work for all users?

 

 

[PFMaBiSmAd]

session_set_cookie_params can be used to set the path. Since it is the 3rd parameter, you will need to set the first two as well -

 

session_set_cookie_params(0,'/','.yourdomain.com');

 

 

[Zola]

Thanks very much.

 

Can you explain what this part does please?

 

(0,'/','.yourdomain.com')

 

I know that the .yourdomain.com attaches my domain to the command, but what does the parts before mean?

 

[PFMaBiSmAd]

The light-blue link session_set_cookie_params is to the php.net documentation for the function. I recommend you start there.