Login Fails after Upgrade from 9.4.8 to 9.5.2

Developing with Concrete
1

I have a site that is running 9.4.8 but when I upgrade the site to 9.5.2 the login completely fails, the message that the user sees is “User is not registered. Check your authentication controller.” and in the Logs I see “Session made it to login_complete but was not attached to an authenticated session.”

  • I have cleared the cache
  • I have verified that the site.sites.default.seo.canonical_url is correct and includes https

I’m not sure how to proceed with troubleshooting. Has anybody else faced this issue and solved it?

I’m frustrated that the 9.5.x release(s) changed so much of the authentication flow but the Release Notes didn’t mention a single thing about those changes. It seems like when the core team is going to ship changes that are likely to cause breakage they should at least provide a warning.

2

That message is coming from the concrete/controllers/single_page/login.php file, The ‘public function login_complete’ lines 219 to 258.

Do you have an override of the login.php file?

3

If you are using an unsecure development server, you could try adding this to your application/config/concrete.php file

return [
    'session' => [
        'cookie' => [
            'cookie_secure' => false,
        ],
    ],
];
4

I figured out where it’s coming from, I just haven’t been able to figure out why the session doesn’t get created. It’s the same thing on 2 servers so not likely to be server settings, and no overrides.

5

Running those two login.php files from 9.4.8 and 9.5.2 through winmerge we get this.
In 9.5.2
Near the top this line:

use Concrete\Core\User\PostLoginLocationUrl;

Near the bottom of 9.5.2 this function:

public function forward($cID = 0)
    {
        $nh = $this->app->make('helper/validation/numbers');
        $rcURL = '';
        if ($this->request->query->has('rcURL')) {
            $requestRcURL = $this->request->query->get('rcURL');
            if (is_string($requestRcURL)) {
                $pll = $this->app->make(PostLoginLocation::class);
                $urlHelper = $this->app->make(PostLoginLocationUrl::class);
                $rcURL = $urlHelper->getAllowedRedirectUrl($requestRcURL);
            }
        }
        if ($rcURL !== '') {
            $pll->setSessionPostLoginUrl($rcURL);
        } elseif ($nh->integer($cID, 1)) {
            $rcID = (int) $cID;
            $this->set('rcID', $rcID);
            $pll = $this->app->make(PostLoginLocation::class);
            $pll->setSessionPostLoginUrl($rcID);
        }
        $this->view();
    }

In 9.4.8
Near the bottom, this function:

public function forward($cID = 0)
    {
        $nh = $this->app->make('helper/validation/numbers');
        if ($nh->integer($cID, 1)) {
            $rcID = (int) $cID;
            $this->set('rcID', $rcID);
            $pll = $this->app->make(PostLoginLocation::class);
            $pll->setSessionPostLoginUrl($rcID);
        }
        $this->view();
    }
6

I tested this in my local dev server by pasting the code from the 9.4.8 file into the 9.5.2 file and was still able to login in to one of my dev sites running 9.5.2.
But, that is only in my dev wamp server.

7

I’ve upgraded over 20 sites the same way that I did this one and none of them have the issue, so I was more looking for somebody else here in the forums who has had this same issue and solved it.