Logging In and Out Problems

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • rcull
    Senior Member
    • Jan 2005
    • 336
    • 4.2.x

    [Forum] Logging In and Out Problems

    Vbulletin 4.2.3.

    I have had users complaining about logging into the forum recently. Today, I actually tried to log out of the forum and I couldn't! I wanted to try logging in as another user. After repeated attempts I seemed to be logged out and successfully logged in as the other user. Then I moved to various parts of the forum and found I was still logged in as myself. To make it more confusing, I found I was still logged into some parts of the site as the user I was testing. I had two current log ins!!!

    It happens on all browsers, and it has come to my attention from forum users having problems. I tried logging out and it is almost impossible!
    My host recently activated mod_lsapi, any chance that might effect it?

    I also just noticed I am getting an insecure password warning in Fire Fox. Maybe a problem with https:?
    Last edited by rcull; Mon 1 May '17, 7:56pm.
  • Mark.B
    vBulletin Support
    • Feb 2004
    • 24286
    • 6.0.X

    #2
    If you are finding old login sessions persisting, then it is some form of caching on the server.
    Speak to your hosts and get them to turn any such caching off...
    MARK.B
    vBulletin Support
    ------------
    My Unofficial vBulletin 6.0.0 Demo: https://www.talknewsuk.com
    My Unofficial vBulletin Cloud Demo: https://www.adminammo.com

    Comment

    • rcull
      Senior Member
      • Jan 2005
      • 336
      • 4.2.x

      #3
      They have turned off opcashe, but the problem seems to persist

      I can log out on one tab, but stay logged in on another!

      Thanks

      Comment

      • Wayne Luke
        vBulletin Technical Support Lead
        • Aug 2000
        • 73976

        #4
        Opcache probably doesn't cause this. The caching that could cause are tools like Varnish and Cloudflare. However, I suggest you delete the cookies for your site directly from your browser. They seem to have been corrupted and aren't being updated properly.
        Translations provided by Google.

        Wayne Luke
        The Rabid Badger - a vBulletin Cloud demonstration site.
        vBulletin 5 API

        Comment

        • Paul M
          Former Lead Developer
          vB.Com & vB.Org
          • Sep 2004
          • 9886

          #5
          Originally posted by rcull
          They have turned off opcashe, but the problem seems to persist
          Opcache has nothing to do with this, thats actually a good thing to have enabled.

          Your issue is content caching, by something like Varnish.

          Baby, I was born this way

          Comment

          • rcull
            Senior Member
            • Jan 2005
            • 336
            • 4.2.x

            #6
            I have disabled most products.
            I log out. I will still show logged in on each tab until it is refreshed.

            I attempt a log in, and the page shows an error: Invalid Redirect URL (http://www.teambuick.com/links/) or Invalid Redirect URL (http://www.teambuick.com/forums/forum.php)

            Logging into the Control Panel seems to work. When I am logged into the CPanel, and log into the forum, I can refresh any tab on the forum and show logged in.

            Mmmmmm..... I think what may be happening is each page needs to be refreshed after logging in or out to show that it has happened. So it may be that the Header Welcome area is not automatically refreshing when a page is loaded to show actual status.

            Thanks

            Comment

            • Mark.B
              vBulletin Support
              • Feb 2004
              • 24286
              • 6.0.X

              #7
              Originally posted by rcull
              I have disabled most products.
              I log out. I will still show logged in on each tab until it is refreshed.

              I attempt a log in, and the page shows an error: Invalid Redirect URL (http://www.teambuick.com/links/) or Invalid Redirect URL (http://www.teambuick.com/forums/forum.php)

              Logging into the Control Panel seems to work. When I am logged into the CPanel, and log into the forum, I can refresh any tab on the forum and show logged in.

              Mmmmmm..... I think what may be happening is each page needs to be refreshed after logging in or out to show that it has happened. So it may be that the Header Welcome area is not automatically refreshing when a page is loaded to show actual status.

              Thanks
              The header area cannot refresh independently of the rest of the page.

              As Paul says, this is content caching of some sort, which will be server side. There isn't a great deal more we can advise, since the issue is not within vBulletin itself.
              MARK.B
              vBulletin Support
              ------------
              My Unofficial vBulletin 6.0.0 Demo: https://www.talknewsuk.com
              My Unofficial vBulletin Cloud Demo: https://www.adminammo.com

              Comment

              • Wayne Luke
                vBulletin Technical Support Lead
                • Aug 2000
                • 73976

                #8
                So... Are you logging in from the URL listed under Settings -> Options -> Site Name / URL / Contact Details? The HTTPS, or lack of security, and whether you have www. or not is important these days.
                Translations provided by Google.

                Wayne Luke
                The Rabid Badger - a vBulletin Cloud demonstration site.
                vBulletin 5 API

                Comment

                • rcull
                  Senior Member
                  • Jan 2005
                  • 336
                  • 4.2.x

                  #9
                  You may be on to something, I hope... You mention "logging in from the URL", I may not quite understand that. I look at Site Name / URL / Contact Details, and notice that I have all the "Component" URLs blank.

                  Forum Home and Homepage URL are both https. Should I be entering the Component URLs? I am not certain I understand the instructions in the descriptions relative to having "Forum URL" correctly set.

                  It may be that the "Header" is not automatically refreshing to each page load. It seems that if you click on a tab it loads the last information unless refreshed, then it loads what it should.

                  Thanks
                  Last edited by rcull; Tue 2 May '17, 7:57pm.

                  Comment

                  • Mark.B
                    vBulletin Support
                    • Feb 2004
                    • 24286
                    • 6.0.X

                    #10
                    As I said above, the header cannot refresh independently of the rest of the page.

                    You should only use ONE url for your forum....with or without www, and with or without https.
                    Whatever you have set in the admincp as the Forum URL is what you MUST use in the forum. You should have any other variants of the URL redirected to the correct one. Logging in from any URL other than that set in the admincp will cause the type of issues you describe.

                    The component url setting is not needed by default and certainly if you never had it set before, you do not need it set now.
                    MARK.B
                    vBulletin Support
                    ------------
                    My Unofficial vBulletin 6.0.0 Demo: https://www.talknewsuk.com
                    My Unofficial vBulletin Cloud Demo: https://www.adminammo.com

                    Comment

                    • Wayne Luke
                      vBulletin Technical Support Lead
                      • Aug 2000
                      • 73976

                      #11
                      So... Due to security issues and how we secure the cookies in vBulletin -

                      If you go to https://www.domain.com then modern browsers will consider this site A.
                      If you go to https://domain.com then modern browsers will consider this site B.
                      If you go to http://www.domain.com then modern browsers will consider this site C.
                      If you go to http://domain.com then modern browsers will consider this site D.

                      Cookies cannot be shared among sites. So if you have site A as your BB URL in the settings and login at site B, you will not be logged into the site until you visit an A URL again. Etc... Etc... Etc...


                      You need to decide what URL you want to use and then redirect the other permutations to that URL using server tools like .htaccess.
                      Translations provided by Google.

                      Wayne Luke
                      The Rabid Badger - a vBulletin Cloud demonstration site.
                      vBulletin 5 API

                      Comment

                      • rcull
                        Senior Member
                        • Jan 2005
                        • 336
                        • 4.2.x

                        #12
                        So, if I have an http: left somewhere that could be the problem, and that could be the reason I get the log in warning in Fire Fox?
                        I "think" I have searched everywhere, but I must have missed something...
                        I will look further...


                        Comment

                        • rcull
                          Senior Member
                          • Jan 2005
                          • 336
                          • 4.2.x

                          #13
                          I think I have always used http://www. on my site and links. But with my recent change to https:, that could really be a curve! I did manage to get the lock to close, and thought I had it won

                          I can see I have many entries of my site with http: in the database. I don't know how to query the database, other than to use the sql search tool. Could someone write me a query to change the http: to https: ?

                          Comment

                          • Wayne Luke
                            vBulletin Technical Support Lead
                            • Aug 2000
                            • 73976

                            #14
                            Your best best is to redirect any HTTP requests to HTTPS using .htaccess or other tool provided by your hosting provider. They can assist you with this.
                            Translations provided by Google.

                            Wayne Luke
                            The Rabid Badger - a vBulletin Cloud demonstration site.
                            vBulletin 5 API

                            Comment

                            • rcull
                              Senior Member
                              • Jan 2005
                              • 336
                              • 4.2.x

                              #15
                              I have had a redirect as follows:
                              RewriteEngine On
                              RewriteCond %{SERVER_PORT} 80
                              RewriteRule ^(.*)$ https://www.teambuick.com/$1 [R,L]

                              I am logged in as one user, I log out. It shows logged out. I move to another tab, I am not logged out until I refresh. I go across the tabs and refresh, they all refresh to logged out. I log in as another user, it does not seem to take, still showing the page as not logged in. I refresh the page, and it shows logged in. I go across the tabs, and each one show as not logged in until it is refreshed.

                              Error log: [04-May-2017 22:35:51 UTC] CSRF state token does not match one provided.

                              I have attached some very temporary access for the site in case you would like to try it.



                              Thanks
                              Attached Files
                              Last edited by rcull; Fri 5 May '17, 6:02am.

                              Comment

                              widgetinstance 262 (Related Topics) skipped due to lack of content & hide_module_if_empty option.
                              Working...