Page 1 of 1

Protection doesn’t accept user after moving the installation

Posted: 21 Feb 2021, 04:39
by fulo
 The day before yesterday I moved my installation to another provider.
Generally it works, but as soon as I actively the (global) password protection, it doesn’t work.
When I try to enter the site, The User/password dialogue appears, but it doesn’t accept the correct input.
I get no error message, but the User/password window appears again and again.

What might be the reason for this issue?

Regards
Philip

Re: Protection doesn’t accept user after moving the installation

Posted: 21 Feb 2021, 11:02
by mjau-mjau
This issue was covered for several users since years ago, as some servers have different implementations of PHP auth. We already covered all possibilities in X3 by looking for optional server variables in the .htaccess file and /app/auth.inc.php. We look for the following vars:
Code
PHP_AUTH_USER, REDIRECT_HTTP_AUTHORIZATION, HTTP_AUTHORIZATION, REDIRECT_REMOTE_USER, REMOTE_USER
Until now, all servers that support PHP auth will forward at least one of these. In addition in .htaccess:
Code
# Allow basic authentication in X3 for servers running PHP as FastCGI
 RewriteCond %{HTTP:Authorization} !^$

  RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},E=PHP_AUTH_USER:%{HTTP:Authorization},E=REMOTE_USER:%{HTTP:Authorization},L]
Basically what is happening, is that after filling the username/password, these are empty when X3 checks them, and therefore you will end up in a loop prompting to login. You will need to ask if your host supports basic PHP auth, which in this case, it seems not.

Re: Protection doesn’t accept user after moving the installation

Posted: 22 Feb 2021, 05:44
by fulo
Thanks for your answer. As for now, I don't get it to work.
Unfortunately, I can't even access the backend, because of the password prompt.
I tried to remove the config/protect.json to get rid of the password protection, but this didn't work.

Any ideas on this?

Re: Protection doesn’t accept user after moving the installation

Posted: 22 Feb 2021, 20:04
by mjau-mjau
fulo wrote:Unfortunately, I can't even access the backend, because of the password prompt.
This is something different. What does your /?dignostics page say? For me to diagnose further, I need link and login to your panel (please send in private message). Sounds to me like your server does not have a "writeable" session path, which is used to store login sessions ... May I ask who the hosting service is? I suspect this hosting does not live up to standards.