i went to look into that code and made this modification so i can see whats the problem in the log: if($this->config->sessionChallenge) { if(empty($_COOKIE[$sessionName . "_challenge"]) ) { $valid = false; $reason = "Error: Invalid challenge value, empty cookie"; // $reason = "Error: Invalid challenge value"; } if(($this->get('_user', 'challenge') != $_COOKIE[$sessionName . "_challenge"])) { $valid = false; $user_challenge = $this->get('_user', 'challenge'); $cookie_challenge = $_COOKIE[$sessionName."_challenge"]; $reason = "Error: Invalid challenge value, no match: sessionName=".$sessionName.', cookie='.$cookie_challenge.'user='.$user_challenge; // $reason = "Error: Invalid challenge value"; } } and this was the result: User 'elbedroom' - Error: Invalid challenge value, no match: sessionName=wire, cookie=user=U.kakjfc.txoyfTz0jWmFM7KipM8lHIo (IP: 0.0.0.0) It seems strange because if the cookie was empty the the log would be for the first option and it would say: "Error: Invalid challenge value, empty cookie", but instead it confirms that the cookie is not empty but then it shows an empty result. When i look for the cookies i see the "wire_challenge" cookie is there, everytime i reload thepage the value changes, and when i logout the cookie disappears, im thinking there is some code deleting the cookie everytime i do a frontend login before it validates the challenge, or something like that...