[Resolved] "Auto sign-in and sign-out users from all domains” does not work

By the way, I find the reporting processes confusing. I was not aware that my report was going to be rewritten by AI. Since I had copied what I wrote in the "Instead I found" section, I am able to paste it back into this thread. Unfortunately I did not copy the other portions, so I feel like a lot of time of trying to give a careful and thorough report of my steps is partially lost.

----------- From the "Instead I found" field --------

After logging into one domain and then navigating via frontend to the other language, I find that I am not logged in on that domain, as evidenced by no WP user bar. Additionally, I am not able to go to a backend URL of the other domain directly without logging in to that domain.

TESTING PROCEDURE
I decided to set up a fresh staging instance on our production server with all default settings. I created a fresh WordPress install, latest version, and created a pair of temporary subdomains of our existing domains to point to the test, one for French and one for English. Then I configured it minimally only to get WordPress functionning, and then installed WPML and configured it as minimally as I could, using the “A different domain per language” option pointing to my two temporary addresses.

WHAT I TRIED
1. On the Setup WPML page, with “A diffferent domain per language” selected, I checked “Auto sign-in and sign out users from all domains.”
2. I clicked Save at the bottom of that immediate section.
3. I clicked the “re-save the site permalinks” link that WPML suggested. This brought me to the Permalink Settings page.
4. Without making any change on the Permalink Settings, I clicked “Save Changes.”
5. I logged out.
6. This brought me to the login page, where I logged in again, checking the “Se souvenir de moi” (Remember me) option.
7. This brought me to the admin, so I used the “Visit Site” link to navigate to the frontend home page.
8. Now at the French home page, on this empty default site, I stop to notice the WP user bar at the top, and then I scroll to the bottom to click the “English (Anglais)” language switcher link.
9. I am now at the English home page, where I see that there is no WP user bar at the top. That indicates I am not signed in on the secondary domain.

Since this is a fresh installation of WordPress with the default theme and no additional plugins except three WPML plugins that I use on my other sites, I conclude this is likely a WPML bug. I created this test environment on a live server so that I may share the credentials with you for you to investigate. Tell me how to privately provide login credentials, and I will.

The ultimate reason that brought me here is that we are adding a new language to one of our sites, and while that language is configured as hidden, we are unable to view the pages even when logged in as an admin user configured to show hidden languages. When I try to view such a page, it returns me back to the home page of the primary domain. I suspect that this issue I reported is related, because I am not signed in on the other domain, and I have no way to sign in on the other domain of a hidden language, because even when I try to sign in to the direct address for the new site for the hidden language, it just sends me back to the home page of the primary domain.

Thank you for your response. I have performed your test:

1. I logged in to that site and deactivated all WPML plugins (which, in this test case, means that no plugins are active).

2. In a new private browser window (logged out), I clicked each of your links to test each domain exactly as you typed them.

The result was that both domains were accessible. They both went to the same home page, although they both were in French, the primary language, which would be expected with WPML deactivated.

I also read the article you linked, and it said that they should all show “the same site without a redirection.” They are not set up to redirect: each is a unique domain that points to the same server directory. Just to make sure, I visited each domain to confirm a 200 response code.

So the issue still remains. Let me know if you have other suggestions. I am also happy to provide login credentials for this test site: it was set up explicitly for this test, including the possibility that you may need to log in.

After trying your test, I have now reactived WPML.

I have heard back from my host. The FTP access details I gave you are correct. Just note that FTP over TLS is required, such as the option "Use explicit FTP over TLS if available"
in FileZilla.

I can confirm that I am reproducing the issue on the testing site that we have been looking at. I have recorded a screencast to demonstrate, available at this link (or please let me know if you have an alternate way you wish to access it):

hidden link

After I first tried to start fresh with a different browser, plugins disabled, and cache cleared for the relevant sites, these are the steps I followed in the first part of the video to demonstrate the issue.

1. Logged in to wpmltest.editionsceb.com admin.
2. Go to the front end.
3. Change language from the front end.
4. Notice that there is no user bar on the front end of the secondary domain, indicating I am logged out on that domain.

Is this expected?

Thus far it is sufficient to demonstrate the problem, but in the video I also tried a couple other things to further investigate the problem.

Thank you for working through this.

Regarding your question, no, I was not using a private or incognito window in my video.

However, your observation that you were able to reproduce the issue only when in Chrome’s incognito mode is an excellent clue. For one thing, it means you have a recipe to reproduce the issue I am having. But secondly, it is the clue that leads us to identify the problem.

I have done some digging, and I have discovered it has to do with the growing trend among browsers to block third-party (cross-site) cookies. I have narrowed it down to the “Prevent cross-site tracking” setting in Safari and the “Block third-party cookies” setting in Brave. Toggling these settings on and off in my testing has shown that the problem can be reproduced or avoided depending on what these are set to.

As I understand it, you should be able to confirm that you can reproduce the problem in Chrome even when not in Incognito mode if you go to the “Privacy and Security” and set “Third-Party Cookies” to “Block all third-party cookies.”

There does not seem to be any way to work around this other than to change the browser settings. In Safari, it is a global setting, so I am not interested in making that change. In Brave, the setting is per-domain, so I can allow it on my own sites, since I know what cookies are being used for there.

Going forward, this feature may need to be revisited by the WPML development team. It seems all of the major browsers allow third-party cookies to be disabled, and Safari, Brave, and Firefox now do so by default. In 2023, Google officially stated, “If your site uses third-party cookies, it’s time to take action as we approach their deprecation” (hidden link). However, I read on another site that this year they reversed that policy for their own browser; they have different priorities than the more privacy-focused browsers. In Google, it is on by default only in Incognito mode, as you discovered. Their help documentation stills says that it is also blocked by default for a test group of 1% of users.

If no change in how this feature is implemented is intended, then I would at least recommend some documentation that cross-site cookies must be allowed for the feature to work.

Thank you for passing this limitation on to the team. I assume that my testing site is no longer needed. Please confirm, because if you do not need it any more, I will delete it.

Thank you for your help. This is too bad, but I understand this will not be an easy issue to overcome, if it is even reasonable to do so at all. Fortunately for our sites, it is mostly only an annoyance to me.

I only recommend adding some documentation for now, probably in the little info tip where the setting may be activated. That could save the next person from a lot of troubleshooting.