Answers.Body: <p>One explanation is that, rather than being logged out of the site, your users are being moved from a site they <em>are</em> logged into to one that they <em>aren't</em> logged into. If your site is served via <code>https://www.example.org</code>, you might see users "suddenly be not logged in" when they visit any of the following:</p>
  
  <ul>
  <li><code>https://example.org</code>, or</li>
  <li><code>http://example.org</code>, or </li>
  <li><code>http://www.example.org</code></li>
  </ul>
  
  <p>If your CMS site isn't configured to "lock in" a specific canonical URL (including protocol and hostname), CiviCRM may bounce people from another URL which they are logged into over to the URL CiviCRM thinks is "correct" (per CiviCRM's <code>civicrm.settings.php</code>). When this happens, the user experience is that they get logged out (but they will then be mysteriously logged back in if they visit the URL they were logged in on before).</p>
  
  <p>Drupal isn't fussy about having a canonical URL, but CiviCRM is, and it's good practice anyway.</p>
  
  <p>If this is the behaviour you're seeing, your best bet is to configure your CMS / webserver / <code>.htaccess</code> to enforce a canonical URL (single hostname and protocol), so that all visitors to alternate URLs are immediately moved over to the preferred / canonical base URL.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-10T09:22:09.177Z
Answers.Text: Thanks @chris-burgess I did this initially, before I rebuilt it the first time, and it was still logging out. I'm not convinced this is the fix but I will set it to avoid it complicating matters.
Answers.UserDisplayName: Rose Lanigan
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-10T12:49:44.613Z
Answers.Text: So, I edited the htaccess file, I tested it to make sure it wouldn't allow me to load a http page, and it's working. And then it's just logged me out again.
Answers.UserDisplayName: Rose Lanigan
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-11T03:54:52.033Z
Answers.Text: The URL `CIVICRM_UF_BASEURL` in `civicrm.settings.php` needs to match your site's canonical base URL (noting that CiviCRM requires you to append a `/` and Drupal's `settings.php` requires you *not* append a `/`) - make sure that all lines up.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-12T10:15:19.257Z
Answers.Text: The civicrm.setting.php file was correct, the drupal settings file was commented out so I've uncommented it and edited it to match the URL (without the / in this case) but I'm guessing this won't make much difference because it's already set in the htaccess file?
Answers.UserDisplayName: Rose Lanigan
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-12T19:04:37.677Z
Answers.Text: It's sounding like this isn't the solution for you sorry Rose! If this *was* the problem, you'd see your browser changing URLs when it happened.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-10T01:49:28.560Z
Answers.LastActivityDate: 2018-01-10T01:49:28.560Z
Answers.UserDisplayName: Chris Burgess
Body: <p>Drupal 7.56 and CiviCRM 4.7.27</p>
  
  <p>I have a site that uses very few add-ons (Views and Chaos tools in Drupal, API csv import in CiviCRM), and a few word replacements with the Grant module. Otherwise, it's an out-of-the-box set up.</p>
  
  <p>Users are frequently logged out for no obvious reason. It's not the same action that triggers it so I can't pin it down to a particular error. My error logs showed a theme hook error but I've switched to a different theme and still not resolved the issue. </p>
  
  <p>My recent log messages look like this (ignore the 'login attempt failed'):
  <a href="https://i.sstatic.net/GK91u.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/GK91u.png" alt="enter image description here"></a></p>
  
  <p>And my top 'Access Denied' errors look like this
  <a href="https://i.sstatic.net/H8TQB.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/H8TQB.png" alt="enter image description here"></a></p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-08T16:53:55.843Z
Comments.Text: Do you have some pages accessed by http and some by https ?
Comments.UserDisplayName: Aidan
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-08T19:41:32.867Z
Comments.Text: Are you using same database for civicrm and drupal or separate database for each?
Comments.UserDisplayName: Prem Patel
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-09T14:24:05.980Z
Comments.Text: It should all be https but I've not forced it in the htaccess file (I usually do but when I reinstalled this site I tried to keep it as simple as possible). I will edit that today to make sure that's not part of the problem.
Comments.UserDisplayName: Rose Lanigan
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-09T14:25:15.240Z
Comments.Text: I'm using the same database for both. I've been discussing this recently with another implementer - is it good practise to use separate dbs for each, and if so, why?
Comments.UserDisplayName: Rose Lanigan
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-09T17:23:35.417Z
Comments.Text: One db or two - that's worth a question in its own right!
Comments.UserDisplayName: Aidan
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-10T12:51:57.230Z
Comments.Text: @Aidan good idea, see https://civicrm.stackexchange.com/questions/22189/one-database-or-two !
Comments.UserDisplayName: Rose Lanigan
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-11T04:00:22.340Z
Comments.Text: Those "Session closed for XXX" suggest that some active logout "action" is happening. Do you see requests for `user/logout` matching those logouts?
Comments.UserDisplayName: Chris Burgess
Tags: <error><user-account>
Title: CiviCRM/Drupal site constantly logging user out
ThreadText: # CiviCRM/Drupal site constantly logging user out
  
  (Asked by: username_0 on 2018-01-08)
  
  Drupal 7.56 and CiviCRM 4.7.27
  
  I have a site that uses very few add-ons (Views and Chaos tools in Drupal, API csv import in CiviCRM), and a few word replacements with the Grant module. Otherwise, it's an out-of-the-box set up.
  
  Users are frequently logged out for no obvious reason. It's not the same action that triggers it so I can't pin it down to a particular error. My error logs showed a theme hook error but I've switched to a different theme and still not resolved the issue.
  
  My recent log messages look like this (ignore the 'login attempt failed'):
  [![enter image description here](https://i.sstatic.net/GK91u.png)](https://i.sstatic.net/GK91u.png)
  
  And my top 'Access Denied' errors look like this
  [![enter image description here](https://i.sstatic.net/H8TQB.png)](https://i.sstatic.net/H8TQB.png)
  
  **Tags:** error, user-account
  
  > **Comments:**
  > **username_1**: Do you have some pages accessed by http and some by https ?  
  > **username_2**: Are you using same database for civicrm and drupal or separate database for each?  
  > **username_0**: It should all be https but I've not forced it in the htaccess file (I usually do but when I reinstalled this site I tried to keep it as simple as possible). I will edit that today to make sure that's not part of the problem.  
  > **username_0**: I'm using the same database for both. I've been discussing this recently with another implementer - is it good practise to use separate dbs for each, and if so, why?  
  > **username_1**: One db or two - that's worth a question in its own right!  
  > **username_0**: @username_1 good idea, see https://civicrm.stackexchange.com/questions/22189/one-database-or-two !  
  > **username_3**: Those "Session closed for XXX" suggest that some active logout "action" is happening. Do you see requests for `user/logout` matching those logouts?  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_3 on 2018-01-10. Score: 1
  
  One explanation is that, rather than being logged out of the site, your users are being moved from a site they *are* logged into to one that they *aren't* logged into. If your site is served via `https://www.example.org`, you might see users "suddenly be not logged in" when they visit any of the following:
  
  * `https://example.org`, or
  * `http://example.org`, or
  * `http://www.example.org`
  
  If your CMS site isn't configured to "lock in" a specific canonical URL (including protocol and hostname), CiviCRM may bounce people from another URL which they are logged into over to the URL CiviCRM thinks is "correct" (per CiviCRM's `civicrm.settings.php`). When this happens, the user experience is that they get logged out (but they will then be mysteriously logged back in if they visit the URL they were logged in on before).
  
  Drupal isn't fussy about having a canonical URL, but CiviCRM is, and it's good practice anyway.
  
  If this is the behaviour you're seeing, your best bet is to configure your CMS / webserver / `.htaccess` to enforce a canonical URL (single hostname and protocol), so that all visitors to alternate URLs are immediately moved over to the preferred / canonical base URL.
  
  > **Comments:**
  > **username_0**: Thanks @chris-burgess I did this initially, before I rebuilt it the first time, and it was still logging out. I'm not convinced this is the fix but I will set it to avoid it complicating matters.  
  > **username_0**: So, I edited the htaccess file, I tested it to make sure it wouldn't allow me to load a http page, and it's working. And then it's just logged me out again.  
  > **username_3**: The URL `CIVICRM_UF_BASEURL` in `civicrm.settings.php` needs to match your site's canonical base URL (noting that CiviCRM requires you to append a `/` and Drupal's `settings.php` requires you *not* append a `/`) - make sure that all lines up.  
  > **username_0**: The civicrm.setting.php file was correct, the drupal settings file was commented out so I've uncommented it and edited it to match the URL (without the / in this case) but I'm guessing this won't make much difference because it's already set in the htaccess file?  
  > **username_3**: It's sounding like this isn't the solution for you sorry Rose! If this *was* the problem, you'd see your browser changing URLs when it happened.  
  
  ---
  
  