CakePHP's Auth->Login not working in production, but works in test

Question

I have a CakePHP website that's been working great.

I just developed a new functionality that at one point auto-logs the user in, and redirects him to a page that's behind the login wall.

This works perfectly well in my dev machine, but in production, the user gets redirected to the login page.

Relevant code: (not much)

    $objCustomer = $this->Customer->findById($customerId);
    $this->Auth->login($objCustomer);
    $this->redirect("/customers/signup");

Customer is the Model that's used for authentication.

In the server, I see that I AM getting redirected to /customers/signup, and that redirects me to /customers/login

The thing that confuses me the most is that this works perfectly in my machine.

I dumped the return value of Auth->Login in the server, and it returns 1, so in theory everything is fine and the user should've been logged in.

Some things I can think of that are different between my machine and the server:

• Dev machine is Windows, Server is Linux. This sometimes introduces case-sensitivity issues, but the signup method i'm redirecting to is all lowercase, I don't see where there could be such a problem here.
• Dev machine is IIS, Server is LiteSpeed. Maybe Litespeed is screwing with something? This would be the first time in over a year running this site in production that i'd find something different because of LiteSpeed
• Production site is over SSL, dev is not. I don't see how this could be a problem.

Any ideas are infinitely welcome!

Thank you!

Answer 1

I had problems too with authentication working fine on my machine in development mode, but not working on the server in production mode. Surprisingly, when I changed the server to development mode it started working correctly. Then I changed back to production, and it was still working. Perhaps it was some cache issue.

Answer 2

After a LOOOONG process of trying different weird things, it turns out it all boils down to this:

ini_set('session.referer_check', $this->host);

That's part of CakePHP's standard security features... It sets that INI setting.

If the request made to the action that'll call Auth->login is coming from another host (domain/subdomain/whatever), PHP will consider the session invalid, which effectively kills the auto-login attempt.