Woocommerce - can't logout on multisite

Question

So I've looked high and low, and found a few posts that describe something similar to what I'm seeing - but nothing that is described fully or has actually been resolved. I have a WordPress multisite and am currently setting up a Woocommerce shop on one of the subdomains. This is a SUBDOMAIN install - which is important, as on my local with a subdirectory setup - everything seems to work okay. Here's the issue:

I login to the woocommerce 'my-account' dashboard from the standard login form. Everything works fine. Then, I click on the 'Logout' link from the woocommerce dashboard.

From here I get redirected to the same page with a notice that says: "Are you sure you want to log out? Confirm and log out". So firstly - I don't want the confirmation to be necessary at all. It looks to me like this fires when the URL contains the logout query var (by default customer-logout), but the nonce is not present or not verified. This shouldn't be the case though... the _wpnonce is included in the url I'm hitting.

Either way - after that happens, clicking the 'confirm and log out' link is where it gets really strange. This redirects me back to the my-account page again, still logged-in. HOWEVER - if I do this on an admin account, I AM logged out of the wp-admin panel. So the logout link IS doing something - and logging me out of WordPress, but I'm still somehow logged-in to Woocommerce.

Now I'm fairly convinced this is a session/cookie issue somewhere. If I hook onto 'template_redirect' myself and dump out the return of wp_get_session_token() its empty. Which if I follow along with how I should be logged out - would result in this error. But I just have no idea why that would be the case? Just to be clear: I'm logging out of the SAME subdomain - same base URL as the my-account page I'm on, and everything is over SSL so its not a case of deleting the insecure cookie, but the secure one is still there, or something to that effect.

I'm inclined to think the solution is going to be somewhere in my wp-config file or an issue in my .htaccess, so here are the details from those:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]

# add a trailing slash to /wp-admin
RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]

RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^([_0-9a-zA-Z-]+/)?(wp-(content|admin|includes).*) $2 [L]
RewriteRule ^([_0-9a-zA-Z-]+/)?(.*\.php)$ $2 [L]
RewriteRule . index.php [L]
</IfModule>

# END WordPress

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php72” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php72___lsphp .php .php7 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit

And the important settings from my wp-config.php:

define( 'WP_ALLOW_MULTISITE', true);
define( 'MULTISITE', true );
define( 'SUBDOMAIN_INSTALL', true );
define( 'DOMAIN_CURRENT_SITE', 'main-site-domain.ca' );
define( 'PATH_CURRENT_SITE', '/' );
define( 'SITE_ID_CURRENT_SITE', 1 );
define( 'BLOG_ID_CURRENT_SITE', 1 );
//define( 'SUNRISE', 'on' );

define('ADMIN_COOKIE_PATH', '/');
define('COOKIE_DOMAIN', '');
define('COOKIEPATH', '');
define('SITECOOKIEPATH', '');

main-site-domain.ca above represents the domain I'm looking at. In other words: site 1 is the site in question, and nothing here should have to do with and other subsite.

Has anybody experienced something like this before? Again - I've seen posts getting at some variation of this, but nothing with a real solid answer, and in my poking around I haven't come up with anything useful yet. Thanks a lot in advance for anybody who can offer help!

Answer 1

So if anybody stumbles across this with a similar issue, my problem was indeed in config. Setting the cookie paths to '' was causing issues, these - like the admin cookie path should have been set to '/'. With that change - everything is working as intended:

define('COOKIEPATH', '/');
define('SITECOOKIEPATH', '/');