A member can log in but sees the logged-out header

Q: A member can log in but sees the logged-out header

The sign-in worked, because /my-account opens, but the header still says "Sign in". In order: The page came from the cache. The page cache is read before the platform knows who is asking, and its key ignores cookies. Once an anonymous visitor has requested a URL, everyone gets that copy, members included. Check the response headers: X-Cache-Status: hit means a cached copy. Load the personal part of the header as a fragment, or prevent caching on pages whose output depends on the visitor ( member pages and the page cache ). A different hostname. The sign-in cookie, token , is set for the exact hostname. A member signed in on example.com is signed out on www.example.com . Redirect every hostname to one. The template tests the wrong thing. isFrontendUser() is also true for a signed-out visitor, because the default type is frontend. Test isLoggedIn() . The fragment is cached too. A script that fetches the header's personal part must fetch it from a page that is never cached for a member, such as one under /my-account .

The sign-in worked, because /my-account opens, but the header still says "Sign in". In order:

The page came from the cache. The page cache is read before the platform knows who is asking, and its key ignores cookies. Once an anonymous visitor has requested a URL, everyone gets that copy, members included. Check the response headers: X-Cache-Status: hit means a cached copy. Load the personal part of the header as a fragment, or prevent caching on pages whose output depends on the visitor (member pages and the page cache).
A different hostname. The sign-in cookie, token, is set for the exact hostname. A member signed in on example.com is signed out on www.example.com. Redirect every hostname to one.
The template tests the wrong thing. isFrontendUser() is also true for a signed-out visitor, because the default type is frontend. Test isLoggedIn().
The fragment is cached too. A script that fetches the header's personal part must fetch it from a page that is never cached for a member, such as one under /my-account.

Template code

{if $_currentUser->isLoggedIn()}
  <a href="{$_url->getPath('account')}">My account</a>
{else}
  <a href="{$_url->getPath('login')}">Sign in</a>
{/if}

{% if _currentUser.isLoggedIn() %}
  <a href="{{ _url.getPath('account') }}">My account</a>
{% else %}
  <a href="{{ _url.getPath('login') }}">Sign in</a>
{% endif %}

That test is correct, but it only helps on a page that is not served from the cache.

Objects ReferenceGenerated from the platform, so it is always current

API ReferenceEvery REST endpoint, in cURL, PHP, Python and JavaScript

A member can log in but sees the logged-out header

More in Members and authentication