Fresh Install: There was a security error when trying to login

One thing that may be screwing me up is that my server isn't setup on a domain name. It's simply a URL. So my configure.php files have this in the settings:

define('HTTP_SERVER', 'http://74.92.6.104');
define('HTTPS_SERVER', 'https://74.92.6.104');
define('HTTP_CATALOG_SERVER', 'http://74.92.6.104');
define('HTTPS_CATALOG_SERVER', 'https://74.92.6.104');

Could this be causing me problems? I don't have SSL set and am not using it for now.

I modified the admin login page to print out both the $_SESSION['securityToken'] value and the $_POST['securityToken'] values if I got the security error, and the thing that is disturbing is that in Safari they don't match up. I'm sure this must be part of the problem but am clueless as to how to fix this.

I continue to get "There was a security error when trying to login." both when attempting to log into the main area or the admin area with Safari 5.0.3. The old version of Safari (5.0.0) worked for logging in, but the new version doesn't work.

Try it yourself. http://74.92.6.104/zen-cart/

Anyone have any ideas here? :frusty:

So I was able to get it working by editing my php configuration and changing the 'session.use_only_cookies' value from 1 to 0. This is not recommended by default, however, so I'm tempted to change the option back if I can find a way around it...

Your PHP configuration was non-standard. session_use_only_cookies would normally be commented out by default e.g.

; session.use_only_cookies = 1

Whilst uncommenting that line would enforce cookie use for all sessions (meaning that the session is stored in a cookie placed on the visitors PC) it would work the same as Force Cookie Use in Zen Cart - which can only be used with no SSL or with Full SSL on an FQDN (Fully Qualified Domain Name).

Vger

@Vger

Your statement is incorrect. Check the PHP documentation: http://www.php.net/manual/en/session.configuration.php#ini.session.use-only-cookies

As of PHP 5.3.3 it defaults to 1. I have multiple installations of OpenSUSE running which both had PHP 5.3.3 and both had session.use_only_cookies set to 1. The Zen Cart documentation should be changed to make note of this.

Also we weren't using any SSL on either of our servers, and it (Zen-Cart login) was working fine with FireFox, Camino, and several other browsers, but didn't seem to work with webkit based browsers such as Safari, Chrome, and Opera.

Your statement is incorrect. As of PHP 5.3.3 it defaults to 1

And you have already proved that the problem disappears if you reset it to 0.

Just because PHP defaults it to 1 in the latest version does not mean that it is the viable setting to use.

Vger

Well the documentation says it defaults to 1 in PHP 5.3.0, but this comment: http://www.php.net/manual/en/session.configuration.php#99671 says that it really defaults there in 5.3.3 (which I think is the correct version where it defaults).

Which is all academic, because whatever PHP says you cannot force visitors to a website to store sessions in cookies, unless they allow it in their browser settings.

Most (major) browsers, by default, allow 1st party cookies, and so most users would be covered by that, but some people alter their default settings not to allow any cookies (which means they could not buy from your site anyway) or use one of the obscure "developer friendly" browsers where disallowing all cookies might be the default.

For instance, Zen Cart has a setting called "Force Cookie Use", which is the same as "session.use_only_cookies = 1" but this can only be used where the site does not use SSL at all or where the site uses Full SSL for https pages. This setting won't work if the site uses Shared SSL, because the http cookie domain will not then match with the https cookie domain.

That PHP setting attempts to do the same thing, and will also result in customers being logged out if they switch to an https page where Shared SSL is used. So you have a choice:

1. Set it to '1' and have a non-functional website

2. Set it to '0' and have a functional website

Vger

If you're just using an IP address instead of a domain name, you may have session problems. Simple fix: don't use an IP address for HTTP_SERVER.

Thanks for the info......

DrByte:

If you switch to Classic template, instead of your custom template, does the problem continue?
If you get rid of FEC, does the problem continue?

1.3.9h problem persists on classic template. I have no idea what FEC is. I find it so funny when you guys talk to each other in your own jargon while there are also 4 year olds here:)

Here is my site

zubenubi:

Hi Dr Byte, I deleted my includes/templates/classic folder and that does seem to fix the problem, I was able to login ok. So I know that the problem is something to do with some file in that folder/subfolders but how do I go about narrowing it all down? Or do I need to be deleting each file individually and see when the problem stops?

thanks, I really appreciate your help with this.

1.3.9h Custom Template: avonlee_contempo
Still struggling! Deleting classic template did not help me, either. So keep searching this big ocean. Customers can't login the website from any of the known browsers. Everybody gets following message
"There was a security error when trying to login." If I resolve this tonight, I will post it to every thread that mentions it. Greetings.
my website

enginarat, you should start your own thread rather than adding on to this one. Adding details of changes made before/after the problem would help as well.