XF 1.5 New Install Cookie Warning

[expanserpb]

Brand new install:

Full install complete, server configuration identical to another build.

First login to adminCP:
"Cookies are required to log in to this site. You will not be able to log in until they are accepted."

Same on the regular login screen.

 

[expanserpb]

On sign up users receive an error: The field '1183719ceff472271594cca7bb74b866' was not recognised. when they try and fill in username. Similar on other forms.

Start again?

 

[Paul B]

Try rebuilding the master data at the /install path.

 

[expanserpb]

Does that require access to the admin CP? (I cannot access that)

 

[Paul B]

No, you can just navigate to domain.com/install.

It does require an administrator account though

 

[expanserpb]

Attempting to log in to that interface also fails. No error message thrown.

 

[jeb35]

Attempting to log in to that interface also fails. No error message thrown.

Are you going to this address?

http://chroniclesrp.net/install/

 

[Paul B]

As it's a new installation, try installing again but it sounds like it's server related, so you may have to contact your host as there may be an issue with serving cookies.

 

[expanserpb]

Aha, found an offending statement in my apache config. It's something I took from my existing install but has a conflict with running without TLS.

I've removed it, will get Certbot and Letsencrypt running and then put it back on!

Thank you for prompt assistance.

 

[Chris D]

Aha, found an offending statement in my apache config. It's something I took from my existing install but has a conflict with running without TLS.

Would you mind clarifying exactly what that statement is?

I think we've seen it a few times recently.

Whatever it is seems to prevent cookies being saved unless you're using a secure connection.

 

[expanserpb]

@Chris D
#set cookie with httponly and secureflag
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure

/etc/apache2/apache2.conf on Ubuntu 16 and apache2

 

[Chris D]

Yep that’d do it. Thanks

 

[expanserpb]

@Chris D

Whilst I had already forced tls 1.2 and put the settings back on I've got another minor issue.

Have undone this and restarted apache.

However, whilst the entire admin CP works there is one exception. If I try and change style properties for any template I get a security exception.

Do you have any clues on what this could be?

 

[expanserpb]

Never mind, permissions on tmp folder. Someone reported a failed avatar upload and it clearly gets used during a style property change