Login redirect_to loop with reauth=1, cookie expiry set to 1 year in past

Question

(I've resolved this - sequencing error in wp-config.php - thanks to this answer elsewhere).

---

I've moved a site dev to production and everything is working correctly except the login form, which is stuck a loop with this URL:

/wp-login.php?redirect_to=https%3A%2F%2Fwww.example.com%2Fwp-admin%2F&reauth=1

• It's an https:// site (though the dev site was as well) and uses a www. prefix

With Chrome Devtools and Application > Storage > Cookies (or Network with 'Preserve log' ticked) open: the authentication cookies are being sent - I'm getting about 16 in all (examples below) from the wp-login.php response (straight after clearing cache) including multiple wordpress_sec and WordPress_logged_in.

However every cookie has an expiry date of 1 year ago (July 2018) so immediately disappears.

I've been going through the WP Core source code, the time() - YEAR_IN_SECONDS line mainly seems to be for situations where the password has been reset.

I verified that $user = wp_signon( array(), $secure_cookie ); **is completing successfully and the user was being sent to /wp-admin, but then redirected from there back to wp-login.php*

Also:

• WordPress_test_cookie has no expiry. It has the correct domain (including www.), / for the path and is Secure, according to devtools
• siteurl and home option values are correct, FQDN with correct protocol and URL definitely spelt correctly (I used wp option get/set, but have also defined them at the top of wp-config.php)
• user/password combinations I've tested are definitely valid (deliberately incorrect entry gives error as expected). I also used WP CLI to reset them, create a test account
• I've tried toggling the theme back to the default one
• I've tried using WP CLI to regenerate the permalinks and delete transients
• I'd regenerated the salts (the location of the salts in the config file turned out to be the solution, see my answer)
• I've tried deactivating various plugins
• It's not a multisite, but I tried defining DOMAIN_CURRENT_SITE anyway - that was my resolution to a similar problem with a different WPMU install
• WP_DEBUG_LOG is true and nothing is being written to wp-content/debug.log
• I've been testing in Chrome with a cleared cache
• The rest of the site is working fine (served via Nginx with a working LetsEncrypt cert).

Any suggestions?

WP core 5.2.2, Nginx 1.14.2, PHP 7.3.4-2, MySQL 10.3.15-MariaDB-1 on Debian 10.0 (Buster)

Sample cookies in response:

set-cookie: wordpress_test_cookie=WP+Cookie+check; path=/; secure
set-cookie: wordpress_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/wp-admin
set-cookie: wordpress_sec_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/wp-admin
set-cookie: wordpress_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/wp-content/plugins
set-cookie: wordpress_sec_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/wp-content/plugins
set-cookie: wordpress_logged_in_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpress_logged_in_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wp-settings-0=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wp-settings-time-0=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpress_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpress_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpress_sec_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpress_sec_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpressuser_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpresspass_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpressuser_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpresspass_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wp-postpass_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
status: 200

Answer 1

This was caused simply by the salts in wp-config.php being at the end of the file, after the call to wp-settings.php (they were inserted by an Ansible script) rather than above the line:

/* That's all, stop editing! Happy publishing. */

:(