Take the 2-minute tour ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.

I have a CakePHP website that's been working great.

I just developed a new functionality that at one point auto-logs the user in, and redirects him to a page that's behind the login wall.

This works perfectly well in my dev machine, but in production, the user gets redirected to the login page.

Relevant code: (not much)

    $objCustomer = $this->Customer->findById($customerId);
    $this->Auth->login($objCustomer);
    $this->redirect("/customers/signup");

Customer is the Model that's used for authentication.

In the server, I see that I AM getting redirected to /customers/signup, and that redirects me to /customers/login

The thing that confuses me the most is that this works perfectly in my machine.

I dumped the return value of Auth->Login in the server, and it returns 1, so in theory everything is fine and the user should've been logged in.

Some things I can think of that are different between my machine and the server:

  • Dev machine is Windows, Server is Linux. This sometimes introduces case-sensitivity issues, but the signup method i'm redirecting to is all lowercase, I don't see where there could be such a problem here.
  • Dev machine is IIS, Server is LiteSpeed. Maybe Litespeed is screwing with something? This would be the first time in over a year running this site in production that i'd find something different because of LiteSpeed
  • Production site is over SSL, dev is not. I don't see how this could be a problem.

Any ideas are infinitely welcome!

Thank you!

share|improve this question

2 Answers 2

I had problems too with authentication working fine on my machine in development mode, but not working on the server in production mode. Surprisingly, when I changed the server to development mode it started working correctly. Then I changed back to production, and it was still working. Perhaps it was some cache issue.

share|improve this answer
up vote 0 down vote accepted

After a LOOOONG process of trying different weird things, it turns out it all boils down to this:

ini_set('session.referer_check', $this->host);

That's part of CakePHP's standard security features... It sets that INI setting.

If the request made to the action that'll call Auth->login is coming from another host (domain/subdomain/whatever), PHP will consider the session invalid, which effectively kills the auto-login attempt.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"//careers.stackoverflow.com?utm_source=stackoverflow.com&amp;utm_medium=site-ui&amp;utm_campaign=footerlink\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2014 stack exchange inc; user contributions licensed under <a href=\"http://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a>                   with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2014.12.28.2142\r\n            </div>\r\n            \r\n        </div>\r\n    </div>\r\n    <noscript>\r\n        <div id=\"noscript-warning\">Stack Overflow works best with JavaScript enabled<img src=\"http://pixel.quantserve.com/pixel/p-c1rF4kxgLUzNc.gif\" alt=\"\" class=\"dno\"></div>\r\n    </no"], "copyright__copyright__copyright": [" part of CakePHP's standard security features... It sets that INI setting.\n\nIf the request made to the action that'll call Auth->login is coming from another host (domain/subdomain/whatever), PHP will consider the session invalid, which effectively kills the auto-login attempt.\n\nshare|improve this answer\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}