Same problem with all-inkl.com SSL-Proxy

by Flinkman, Friday, May 31, 2013, 20:25 (4303 days ago) @ soyale

I've spend some time to solve the problem and found a solution.
I'm not sure if it is the best one, but it works well.

It is a "simple" problem with the needed cookie!
Currently selfoss does not set the domain and path correctly if you use a SSL proxy.

In "helpers/Authentication.php" find these two lines

// session cookie will be valid for one month
session_set_cookie_params((3600*24*30), "/");

and replace them with these lines

// check for SSL proxy and special cookie options
if(isset($_SERVER['HTTP_X_FORWARDED_SERVER'])) {
// set cookie details (http://php.net/manual/en/function.setcookie.php)
// order: expire, path, domain, secure, httponly
session_set_cookie_params((3600*24*30), '/'.$_SERVER['SERVER_NAME'].preg_replace('/\/[^\/]+$/','',$_SERVER['PHP_SELF']).'/', $_SERVER['HTTP_X_FORWARDED_SERVER'], "true", "true");
} else {
// session cookie will be valid for one month
session_set_cookie_params((3600*24*30), "/");
}

From now on it is checked if you use a SSL proxy and the cookie details are set correctly.