Problem with exp_flash cookie and (I suppose) server settings
Development and Programming
I have a problem that I never seen in ExpressionEngine. After logging in CP and save some settings, a cookie is saved on my PC (exp_flash) and I can’t navigare the CP anymore, untili I delete that.
The exp_flash cookie has this content (that is the same content I have in local dev, where I haven’t errors).
%7B%22alert%3Ainline%3Ashared-form%22%3A%7B%22title%22%3A%22Preferences+updated%22%2C%22body%22%3A%22%3Cp%3EYour+preferences+have+been+saved+successfully.%3C%2Fp%3E%22%2C%22severity%22%3A%22success%22%2C%22can_close%22%3Atrue%7D%7D486ee6e95b18ff537160b07c286b16d362830aac400f95a51a1dc2f00235267bed806a81a6c38f8ef023567cbd146b99After some tests I believe is a problem of server and (maybe with SSL that is active!?).
Does anybody have some suggestion? Thank you!
- What do you mean you can’t navigate the control panel any more? What breaks? What happens?
- What version of ExpressionEngine are you using?
- What browser and version?
- Are you using a custom language pack?
Trying to replicate error in another server I found that it was a mod_security issue: disabling that everything returns to normal.
The CP was not navigable because the page didn’t redirect and I received 404 error. I use Chrome 69, ExpressionEngine 3.5.17 and none custom language pack. The hosting provider is Aruba Business. I asked for some detailed explanations. I’ll let you know!
Aruba Business’ support replies that 2 rules of mod_security2 generate false positives. Rules id are: 950901 e 950120. Unfortunately I can’t disable them in htaccess so they do it for me! Everything goes fine now!
Thanks
Yeah you will need to ask them to whitelist your control panel URL from any content-based rules in mod_security, if not all together. It’s an admin panel, so you are regularly going to be submitting POST requests that would look “naughty” if it came from an unauthorized visitor on the front end.