0

I ran into the below problem that blocks my users to log into my site:

When the user needs to log in she gets a notification email with a button that links to the below address: https://www.gonativeguide.com/de/backoffice/markavail?inquiry=437

Joomla changes the above link to the below one, asking the user to log in: https://www.gonativeguide.com/de/component/users?view=login&Itemid=214

Previously this worked perfectly fine. But since yesterday, my users get the below error message:

"Warnung Der Sicherheitstoken ist falsch. Die Anfrage wurde zurückgewiesen, um eine Sicherheitsverletzung zu verhindern. Bitte die Seite aktualisieren und erneut versuchen."

I believe this is equivalent to:

"The most recent request was denied because it contained an invalid security token. Please refresh the page and try again"

I think I could find a workaround to the problem: If I log in by typing www.gonativeguide.com/login and THEN click the link in the email, then it seems to be working. However it is super embarassing to ask my users to do so all the time, so I'd like to find a solution to the problem.

I read through the related (lengthy)forums talking about the invalid security token problem and tried the below suggestions, but none helped:

  • Flush cache at the host
  • Flush cache in Joomla
  • Checking if the System - Page cache plugin is disabled (it was disabled)
  • Empty the _session table in the Joomla database
  • Upgrading Joomla to the latest version
  • Fixing the database (Extensions / Manage / Database)
  • Extending the session timeout to 10 hours

As a sidenote: a few days ago I added some new entries to the .htaccess file to redirect the non-www and http requests to https://www. Not sure if this has anything to do with the problem.

It seems that this is not a new issue, but please let me know, if based on the above description, you can suggest anything to fix this in my case.

Thanks, W.

UPDATE: It turned out that the below .htaccess entry was causing the issue. Can somebody explain, what is wrong with this and how to write it properly to direct all requests to https://www...?

## Begin - Custom redirects
#
# If you need to redirect some pages, or set a canonical non-www to
# www redirect (or vice versa), place that code here. Ensure those
# redirects use the correct RewriteRule syntax and the [R=301,L] flags.
#

## Force https and www
#RewriteCond %{HTTPS} off [OR]
#RewriteCond %{HTTP_HOST} !^www\.gonativeguide\.com$ [NC]
#RewriteRule ^(.*)$ https://www.gonativeguide.com/$1 [L,R=301]

## Remove trailing slash if not directory
#RewriteCond %{REQUEST_FILENAME} !-d
#RewriteCond %{REQUEST_URI} (.+)/$
#RewriteRule ^(.*)/$ https://www.gonativeguide.com/$1 [R=301,L]

## End - Custom redirects 
  • Under the Global Configuration settings menu item and the Site tab, is there a value in the 'Cookie Settings' ? Both fields can be blank and I think this is the recommendation these days, but if you have a non https entry it maybe causing you issues. And have you changed the Force HTTPS setting under the Server tab to match your changes in the .htaccess? – Irata Jul 30 at 8:56
  • thanks for the comments. Yes, the Cookie settings are blank. I was not aware of this Force HTTPS setting. I assume I should switch it to "Entire site", if .htaccess entry redirects all requests to https:://www..... Am I right? Thanks! – wanderlusted Jul 30 at 9:21
  • 1
    Another thing that might help with your issue, or once it is fixed make it easier for your user, is to make sure the user selects 'Remember Me' when they login and that should avoid the login screen each time they click on a link in the email. – Irata Jul 30 at 9:32
  • 1
    And when was the last time you know it worked? You mentioned it 'since yesterday' but is that the day it first failed or when you first noticed it not working. If you can narrow down the window between 'last worked' and 'not working' we can see if your .htaccess changes or some other changes have occurred. – Irata Jul 30 at 9:40
  • 1
    The .htaccess looks right to me so it is likely to be some other conflict with the User and Joomla. You don't mention doing anything with the user like clearing their browser Cache or their Cookie for the site. You mention other people can login so this supports the idea the issue is more local to the user involved. – Irata Jul 30 at 10:48
0

After some experimentation and with the help of @Irata, it turned out that the new .htaccess entry was causing the problem. With this entry I can reproduce the issue 100%, removing the entry solves the problem. I don't know why this entry conflicts with the security token, but will close this ticket and open a new one for this question. Please see below the .htaccess entry:

## Begin - Custom redirects
#
# If you need to redirect some pages, or set a canonical non-www to
# www redirect (or vice versa), place that code here. Ensure those
# redirects use the correct RewriteRule syntax and the [R=301,L] flags.
#

## Force https and www
#RewriteCond %{HTTPS} off [OR]
#RewriteCond %{HTTP_HOST} !^www\.gonativeguide\.com$ [NC]
#RewriteRule ^(.*)$ https://www.gonativeguide.com/$1 [L,R=301]

## Remove trailing slash if not directory
#RewriteCond %{REQUEST_FILENAME} !-d
#RewriteCond %{REQUEST_URI} (.+)/$
#RewriteRule ^(.*)/$ https://www.gonativeguide.com/$1 [R=301,L]

## End - Custom redirects 
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.