logged out

Post by **Friday** » Mon Mar 06, 2006 10:31 am

i keep getting logged out of my account.

i'll be using mb.c and posting and i'll hit reply and all of a sudden it asks me to log in again.

it' seems to be happening a heap in the last two weeks.

is this just me or something to do with the site?

thanks

sneaky hands · Post by **sneaky hands** » Mon Mar 27, 2006 12:28 pm

happens to me loads.. try checking the "always log me in" checkbox when you sign in and it seems to fix it, at least temporarily.

Post by **Friday** » Tue Mar 28, 2006 2:39 pm

i've tried that but it doesn't help

lucas, karl: you know why this is? is it something to do with my set up, firewall or something? or something to do with the site?

Post by **lucas** » Tue Mar 28, 2006 4:19 pm

Trying to trace this now. Not quite sure what would cause it. Will keep you posted.

Post by **fooishbar** » Tue Mar 28, 2006 6:30 pm

lucas wrote:Trying to trace this now. Not quite sure what would cause it. Will keep you posted.

i never seem to get logged out mid-session, but when I change IP (home -> work), going to the new posts search directly asks me to log in. after I do that, it always claims no new posts.

Post by **system** » Tue Mar 28, 2006 7:29 pm

fooishbar wrote:
lucas wrote:Trying to trace this now. Not quite sure what would cause it. Will keep you posted.
i never seem to get logged out mid-session, but when I change IP (home -> work), going to the new posts search directly asks me to log in. after I do that, it always claims no new posts.

as it should.

the phpBB session information associates you with a particular IP. when your client IP changes, so does your session information - hence the forced logout.

not sure about Friday - perhaps the cookie information in her browser is borked slightly?

Post by **fooishbar** » Tue Mar 28, 2006 7:32 pm

system wrote:
fooishbar wrote:
lucas wrote:Trying to trace this now. Not quite sure what would cause it. Will keep you posted.
i never seem to get logged out mid-session, but when I change IP (home -> work), going to the new posts search directly asks me to log in. after I do that, it always claims no new posts.
as it should.

the phpBB session information associates you with a particular IP. when your client IP changes, so does your session information - hence the forced logout.

argh, sux. but it still doesn't explain the newposts thing: when I need to log in after directly requesting search.php?search_id=newposts, all the posts are marked read.

not sure about Friday - perhaps the cookie information in her browser is borked slightly?

it wouldn't been the first time I'd seen a borked DHCP setup that assigned you new IPs mid-flight ...

Post by **system** » Tue Mar 28, 2006 9:34 pm

fooishbar wrote:
system wrote:
fooishbar wrote: i never seem to get logged out mid-session, but when I change IP (home -> work), going to the new posts search directly asks me to log in. after I do that, it always claims no new posts.
as it should.

the phpBB session information associates you with a particular IP. when your client IP changes, so does your session information - hence the forced logout.
argh, sux. but it still doesn't explain the newposts thing: when I need to log in after directly requesting search.php?search_id=newposts, all the posts are marked read.

yeah, it does - from what you said, when you change IPs you are immediately logged out. the time from when you were logged out, to when you are logged back in, is what is calculated when you request a search for all new posts.

Post by **Friday** » Thu Apr 06, 2006 3:28 pm

thanks for looking into it peeps

let me know if you come up with any ideas about what could be causing it....

Post by **fooishbar** » Thu Apr 06, 2006 3:33 pm

system wrote:
fooishbar wrote:argh, sux. but it still doesn't explain the newposts thing: when I need to log in after directly requesting search.php?search_id=newposts, all the posts are marked read.
yeah, it does - from what you said, when you change IPs you are immediately logged out. the time from when you were logged out, to when you are logged back in, is what is calculated when you request a search for all new posts.

almost, but if I log in as usual, then search for new posts, all is fine. but if I'm brought straight to the login page by newposts, then it all goes sideways?

sternumbreaks · Post by **sternumbreaks** » Thu Apr 06, 2006 4:37 pm

you haven't installed any new or recent firewall software or anything of the sort? could be a factor.

Post by **fooishbar** » Thu Apr 06, 2006 4:38 pm

Risky wrote:you haven't installed any new or recent firewall software or anything of the sort? could be a factor.

no, that's not it.

sternumbreaks · Post by **sternumbreaks** » Thu Apr 06, 2006 5:10 pm

No worries.
Similar occurances happened to me when i hadn't set rules etc for firewalls.

Post by **system** » Thu Apr 06, 2006 6:34 pm

fooishbar wrote:
system wrote:
fooishbar wrote:argh, sux. but it still doesn't explain the newposts thing: when I need to log in after directly requesting search.php?search_id=newposts, all the posts are marked read.
yeah, it does - from what you said, when you change IPs you are immediately logged out. the time from when you were logged out, to when you are logged back in, is what is calculated when you request a search for all new posts.

almost, but if I log in as usual, then search for new posts, all is fine. but if I'm brought straight to the login page by newposts, then it all goes sideways?

your IP changed. the security model in phpBB is set to log you out if your IP changes mid-session.

Post by **fooishbar** » Thu Apr 06, 2006 6:52 pm

system wrote:your IP changed. the security model in phpBB is set to log you out if your IP changes mid-session.

so your last visit is your original hit to search.php, before it can notice the IP change and invalidate your session ... damn.

Post by **system** » Thu Apr 06, 2006 8:03 pm

fooishbar wrote:
system wrote:your IP changed. the security model in phpBB is set to log you out if your IP changes mid-session.
so your last visit is your original hit to search.php, before it can notice the IP change and invalidate your session ... damn.

yep and yep. it's the right approach, otherwise I'd be spoofing your session right now, baby!

Post by **fooishbar** » Thu Apr 06, 2006 8:42 pm

system wrote:
fooishbar wrote:
system wrote:your IP changed. the security model in phpBB is set to log you out if your IP changes mid-session.
so your last visit is your original hit to search.php, before it can notice the IP change and invalidate your session ... damn.
yep and yep. it's the right approach, otherwise I'd be spoofing your session right now, baby!

eh, given that people can just inject random shit into the db anyway, I'd be lying if I said I cared about people stealing my cookies and stealing my session from a different IP.

maybe I should start GPG-signing all my posts

Ag3nT[]0raNg3 · Post by **Ag3nT[]0raNg3** » Thu Apr 06, 2006 8:49 pm

nerds

Post by **system** » Fri Apr 07, 2006 8:24 am

fooishbar wrote:
system wrote:
fooishbar wrote: so your last visit is your original hit to search.php, before it can notice the IP change and invalidate your session ... damn.
yep and yep. it's the right approach, otherwise I'd be spoofing your session right now, baby!
eh, given that people can just inject random shit into the db anyway, I'd be lying if I said I cared about people stealing my cookies and stealing my session from a different IP.
maybe I should start GPG-signing all my posts

Neal Stephenson called. he wants his royalties now.