<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>Hello all,</p>
<p><br /></p>
<p>I have a problem with the Cookie authentication. I will try to explain my setup and the appearing problem as good as possible. It's a bit complicated due to the fact, that there is no error message in the interface and in the logs.</p>
<p><br /></p>
<p><strong>Setup</strong></p>
<p><br /></p>
<p>The system is an Ubuntu 16.04 LTS (Xenial) with PHP-FPM, Nginx and MySQL installed from the package repositories.</p>
<p><br /></p>
<p>I use PHP-FPM pools, where every pool, has an own chroot.</p>
<p><br /></p>
<p>Nginx connects to PHP-FPM with Unix-Sockets.</p>
<p><br /></p>
<p>I am using phpMyAdmin version 4.6.5.2.</p>
<p><br /></p>
<p><strong>Problem</strong></p>
<p><br /></p>
<p>phpMyAdmin is installed and accessible on a subdomain. All traffic is exchanged via HTTPS.</p>
<p><br /></p>
<p>Actually phpMyAdmin connects to MySQL via TCP connection. The problem is, that the Cookie authentication doesn't work. So if I set $cfg[auth_type] = "cookie"; I can't login to phpMyAdmin. The interface and the logs doesn't show any errors. When I change the mentioned variable to "http" so that HTTP Auth is used, the login works without problems.</p>
<p><br /></p>
<p><strong>Configuration</strong></p>
<p><br /></p>
<p>I use a few special PHP settings for security reasons. They are mostly the same as in the OWASP PHP Configuration Cheat Sheet. This document can be found here: <a href="https://www.owasp.org/index.php/PHP_Configuration_Cheat_Sheet">https://www.owasp.org/index.php/PHP_Configuration_Cheat_Sheet</a></p>
<p><br /></p>
<p>As I said no error is shown, and no error goes into the PHP log of the pool. I think all is related to the cookie or session handling, but I don't know how I could debug this.</p>
<p><br /></p>
<p><strong>Checked Things</strong></p>
<p><br /></p>
<p>I already checked the following:</p>
<p><br /></p>
<p>1. The mcrypt extension is installed</p>
<p>2. Session data can be stored correctly</p>
<p>3. Disable the cookie and session related settings</p>
<p><br /></p>
<p><strong>Conclusion</strong></p>
<p><br /></p>
<p>I have checked some things but couldn't figure it out. So I would be happy about every type of help. If more information is needed please tell me what exactly is necessary.</p>
<p><br /></p>
<p>P.S. Sorry for my bad english.</p>
<p><br /></p>
<p><br /></p>
</body></html>