It is not a bug and there is no error happening so no error is logged.

There was an intended change in the way we use SSL as of verison 2.3.7.6, discussed in the article Use SSL.

If you have it configured as we recommend so that no cookies are passed unless using SSL, then what happens is if you are redirected or click a link that takes you out of ssl the cookies are not passed and therefore you do not appear to be logged in. But no code in mojoPortal should be redirecting you out of ssl after creating a page. If there are steps to produce that I would investigate it as a bug. But if you are creating links with the http rather than relative urls or https and clicking those links then it will appear as if you are not logged in on those insecure requests. Clicking the sign in linlk takes you back to a secure page thus the cookies are passed again and you then apprear to be already logged in.

The changes in mojoPortal are designed to keep a user in SSL for the remainder of his browsing session after signing in, but if you have links in content that are not relative and just use http then you may find yourself not in SSL and not appearing to be logged in. You could remove the web.config setting and then cookies will be passed even when you are not in SSL so there will be no case where you don't appear to be logged in but if you do that there is some risk of cookie hijacking on public wifi networks.

Another option is to check the box to Require SSL on all pages in site settings. Then even if you do click a link that has http it should redirect to https.

Hope that helps,

Joe

Hi Crispin, I just tested your scenario on the mojoPortal demo site, which is configured for extentionless URLs, and it's working as expected, so you may have a misconfiguration somewhere in your settings that's causing this.

Extensionless urls are only going to work with an IIS 7.x Integrated App pool, it won't work correctly in Classic or in IIS 6.

It "should" work with only preCondition="" on

<modules>

<add name="mojoUrlRewriter" type="mojoPortal.Web.UrlRewriter, mojoPortal.Web" preCondition=""/>

<add name="AuthHandlerHttpModule" type="mojoPortal.Web.AuthHandlerHttpModule, mojoPortal.Web" preCondition=""/>

but if it doesn't work correctly for you then you may need to change from

<modules>

to

<modules runAllManagedModulesForAllRequests="true">

Hope that helps,

Joe

The only thing that changed in that regard is in version 2.3.7.6 we had by default:

<modules runAllManagedModulesForAllRequests="true">

in 2.3.8.1 we changed it to just

<modules>

because it was found that preCondition="" was sufficient to make extensionless urls work.

neither of these changes is related to authentication. The only change related ot that has to do with SSL.

I'm sorry you are having this problem but I don't believe it was caused by the upgrade. It is not a reproducable problem on my end and no one else has reported it which makes me believe it is something with your IIS configuration.

Best,

Joe