security error when trying to login v1.3.9h (Netfirms)

[fairydust]

Okay, this one is getting on my nerves since it's on the customer side! I created an account for testing, as soon as I get through the ordering process and logoff, then attempt to login I get the dreaded "There was a security error when trying to login."

I checked already for this issue and bug fixes, found the error for 1.3.8 and went to those files to find the bug fix was included... so, now what do I do?

The big issue is this site has to be up and fully functional for the end of the month as I am running a promotional campaign for it!

[JSWeb]

Hi fairydust

Thanks for the post and I'm willing to help.

Will need:

- Store URL
- Zen Cart Version: v1.3.9h (Fresh install or upgrade?)
- Confirmation if an SSL is installed

Much appreciated

[fairydust]

Thank you so much...

URL - http://fairydustings.com/shop

fresh install of 1.3.9h - full delete of 1.3.8 and all database files before installation.

shared SSL certificate with Netfirms.


hope this helps!

[DrByte]

shared SSL certificate with Netfirms

There's your problem.

Netfirms did some very bad stuff to their server farm lately, and broke all kinds of things.

Log a ticket with them and get them to fix their broken servers.

Or better yet find a host that actually works. Netfirms has just gone downhill badly in the last few months. Several forum threads on the topic, as well as elsewhere.

[fairydust]

gotcha! have been with them and without complaint for several years now, and wasn't happy to get involved with TuCows... you're right, time to bark at them. Thanks

[fairydust]

well, they kicked me back here saying it's in the admin settings of ZenCart. I have checked, I am attached to the correct database and such... all I want is for my customers to be able to log in and out like they should.

I have since installed other software that require user logins and they are working just fine, which leads me to believe there is something wrong in my settings.

[DrByte]

You have all kinds of options:
a) get a dedicated SSL certificate ... which is certainly a better experience for your customers anyway
b) fix whatever's wrong with your configuration to use shared SSL on your server -- this might help: https://www.zen-cart.com/tutorials/index.php?article=14
c) move your site to another hosting company whose servers work traditionally and more reliably
d) You could adjust the cookie dot-prefix settings in your Admin->Configuration->Sessions screen. ALERT: mussing with other settings in there is risky and likely to create additional problems, including making your login issues even more complicated.
e) You could also look at the other threads on the forum which deal with NetFirms and SSL issues ... I don't recall any of them actually finding a workable solution since the Netfirms server change took place and broke everyone. If Netfirms insists the problem is a Zen Cart issue, then why was your site working fine BEFORE they moved everything, and then suddenly is all broken AFTERward? And why then are they sending you back HERE for a fix to something they broke?


Also,you said you did a fresh install and then reloaded your database. Did you happen to try a clean fresh install with just demo data, and test whether things worked properly before loading all your database into it?

[fairydust]

This was a completely clean install with new DB. This was downloaded and installed by FTP, and not their install, so I know all files were transferred. Admin login works fine, every other function works fine, other software also using shared SSL working fine, just this one function that has failed.

Purchasing a dedicated SSL certificate is an option I will be considering, but changing hosting services is not since I am currently hosting multiple sites and I don't have a lifetime to transfer these sites over to another service.

I can't verify that 1.3.9 worked prior to the transfer of servers, I waited for the transfer to do the install. I previously ran 1.3.8 on the old server, but took it down completely prior to the move and was about to abandon it for another cart product all together.

I will provide Netfirms with the information from the tutorials article and ask if they can look at this once again... before I back up my data and change carts.

[DrByte]

Keep in mind that the "there was a security error when trying to login" message (as discussed in numerous other threads which you said you've already read) indicates that either the user has entered an invalid username/password combination, or the securityToken on the page cannot be validated. The securityToken gets validated by checking to see whether that is a valid token for the currently active "session". And, that can only happen if the session has been properly started. And part of starting the session is setting a session cookie in your browser. And if that session cookie can't be set, or isn't set for the domain name that matches the URL in your browser, then the session can't be started and thus the token can't be validated and thus the login can't take place. In a shared-ssl setup such as yours, the domain matchup is prone to be problematic. Hence the strong recommendation to avoid their shared ssl setup.

[fairydust]

I found the problem, it was software side, but it was an error in the install. I installed to another unused domain name on my server and realized it worked perfectly. The errors were with the SSL and now that I found the problem, the fix is a little tedious but worth it.

Will be backing up the current site, deleting it from the server, and doing a fresh install (properly) and inserting my information and stylesheet again.

Thanks anyhow, but the error was made by me on install and really had nothing to do with Netfirms... having said that, if the site was migrated I could see where the same error would be generated.