Can't Log Out

I had this problem as well using Nop 1.90, and I believe I have fixed it by setting the domain without www. everywhere a cookie is set.

I used the "Find in Files" feature of Visual Studio to find either "Cookies.Add" or "Cookies.Set"
and then right before the cookie gets added or set, i set the domain.  I have done this like this:

cookie.Domain = IoC.Resolve<BusinessLogic.Configuration.Settings.ISettingManager>().StoreUrl.Replace("http://www.", "").Replace("http://", "").Replace("/", "");

You will need to change the cookie name in "cookie.Domain =" for a few places.

this will work for all locations except the one in CommonHelper.cs . . to fix this one I just moved the entire subroutine SetCookie to NopContext.cs and updated the references to it within NopContext.cs

After building the solution, and deleting all cookies from the client machine, it seems this issue has been resolved.

Let me know if anyone has any problems.


EDIT:
This problem actually came back when I was doing some furthur testing.  If i logged in from a non www. url . . and then tried to logout from a www. url . . I once again could not log out.


So . . I set the domain for the forms authentication to non www. in the web.config and this actually fixed it.  See below, I added what is in bold.  be sure to replace yourdomain.com with your actual domain without the www.

<authentication mode="Forms">
    <forms name="NOPCOMMERCE.AUTH" loginUrl="~/login.aspx" domain="yourdomain.com" protection="All" timeout="43200" path="/" requireSSL="false" slidingExpiration="true" defaultUrl="~/default.aspx" enableCrossAppRedirects="false"/>
</authentication>

Done and done.

or you could add a url rewrite rule

see :

https://www.nopcommerce.com/boards/t/2505/force-redirect-from-wwwdomaincom-to-domaincom.aspx

( this helps with an ssl issue also )

haydie wrote:

I am actually already forcing the www. on urls.   The reason for setting the cookies to non-www is so that the cookie will work for any subdomain on that domain.   Whether it be domain.com, www.domain.com, sub.domain.com . . it doesn't matter . . cookies written for domain.com will be accessible by all subdomains.