Users keep losing their sessions

[v-w]

Some of my users are having trouble staying logged in. I had hoped that an upgrade from vBulletin4 to vBulletin 5 would fix the issue, but the problem is still there. The problem is cross-browser. Since I don't have the problem myself, I have no idea how to debug this.

From one of my users:

Nothing happens when I click on any function and I can’t stay logged in. I managed to remain logged in briefly for about 5 minutes but all attempts to post a picture failed because nothing at all happened when I clicked on the ‘post’ button - I just stayed stuck in the posting box. Now I can’t log in at all. Again – it appears to accept my log-in (no ‘failed log-in’ box appears) but I’m immediately logged out.

The board is running version Version 5.4.3 now (without https).

[Wayne Luke]

Logins require valid cookies to be written to the user's computer. If they are blocking cookies or Javascript on your site, they will have a hard time staying logged in. In addition, vBulletin 5 uses cookies that are more secure. As such the cookie for https://domain.com is different than https://www.domain.com. The cookies for HTTPS and HTTP are different as well. So they need to make sure they are always using the URL specified in your AdminCP under Settings -> Options -> Site Name / URL / Contact Details. If you have multiple URLs leading to your forum, they should perform a redirect to the specified URL before the page loads for the user.

Likewise posting requires Javascript. If they are blocking any of the Javascript on your site, this can cause errors that prevents all Javascript from working. That is the nature of the Javascript engines used these days.

[v-w]

Thanks! I have added a redirect rule to Apache in the vbulletin directory, let's see if it helps.

RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ http://%1%{REQUEST_URI} [R=307,L]

[v-w]

Unfortunately, the redirect rule didn't help:

I still can't stay logged in - I got as far as the posting box and tried to post a picture but couldn’t submit it - the post button changes colour as though something is going to happen, but I stay stuck in the posting box. If I close it I get a login pop-up. If I enter my login I just end up stuck in the log-in box, just the same as in the posting box. I have no option but to close and then find I'm logged out. Like Monday, if I then try to log-in again from the top I get nowhere at all - it immediately reverts back to being logged out, even though it seems to accept the password. This time, though, it finally came up with a failed attempt box for an incorrect password. But I know it was correct.

[Wayne Luke]

You lost me at login popup. vBulletin doesn't have any login popups unless you are an Administrator or Moderator trying to use inline moderation. That is much different from posting new content. A regular user will never see this popup.

We're going to need exact steps to reproduce including the users OS, browser and what extensions they have installed.

[v-w]

Well, my user is an artist and not a programmer, so she doesn't know the difference between a pulldown and a popup, and neither should she have to. So, of course she sees a "login popup", that's the thing that comes up when you click on "Login or Sign Up".

Seems like the problem has resolved itself now though, so I guess it was her browser cache getting in the way of the fix.

Thank you very much for all your help!

[Wayne Luke]

Logins are controlled by the end-users computer. We write cookies to their computer and process those cookies with Javascript that runs on their machines. If the settings of their machines prevent these cookies and/or Javascript from operating correctly in the browser then they will be logged out. If they do not check remember me and do not load a page every 15 minutes, they will be logged out.

The Login box does not popup automatically in a normal installation using a modern browser (Chrome, Edge, Firefox, Safari (Apple products only)). We do not support any version of IE except IE 11 and do not support Opera or Fringe Browsers. However most browsers based on Canary or Chromium should work.

[v-w]

Is the session timestamp refreshed properly on every click? I just did a bit of testing myself with a registered user account. Paused to come over here and compose a post, then went back to the forum. Clicked on a forum, still logged in. Clicked on a topic, got logged out.

Affected browsers so far:

• Internet Explorer 11 (no extension installed) on Windows 10
• Safari Version 11.1.2 (13605.3.8) on OS High Sierra 10.13.6 (extensions unknown)
• Firefox version 61.0.1 OS High Sierra 10.13.6 (extensions unknown).

I'll advise my users to tick the "remember me" box to see if it gets any better.

[Wayne Luke]

Cookies are updated on page load, not per click.

Does the URL set in your AdminCP match the URL that you're accessing the site with? Because www.domain.com is a different site from domain.com as far as the cookies are concerned. https://www.domain.com is a different site from http://www.domain.com. On the server level you need to redirect all users to the URL specified in the AdminCP.

[v-w]

Checking "Remember me" solves the issue. The arbitrary logouts are still weird though - our session length is set to 3600. I made sure to access the forum with the exact link (without www) and encountered the problem. So, the only reason to need a redirect here was is vBulletin itself would arbitrarily add "www." in front of the domain, which would be really strange bug.

[Wayne Luke]

vBulletin uses the URL specified in the Settings under Options -> Site Name / URL / Contact Details.

[v-w]

I used http://viggo-works.com/vbulletin for testing. Screenshot attached in case there is a misconfiguration.

[Wayne Luke]

Does the problem persist after deleting cookies and cached files for your site?

What does your .htaccess file look like?

[v-w]

I just did the following:

1. Open Internet Explorer 11
2. Delete browsing history, including cache and cookies
3. Navigate to http://viggo-works.com/vbulletin/forum/
4. Log in without the "remember me" box
5. Click on a thread, then on a couple of bread crumbs

This logged me out - all clicks where done in less than a minute, so it can't be a session timeout.


My .htaccess for vBulletin starts like this:

<IfModule mod_rewrite.c>
    RewriteEngine On

    # In some cases where you have other mod_rewrite rules, you may need to remove the
    # comment on the following RewriteBase line and change it to match your folder name.
    # This resets the other mod_rewrite rules for just this directory
    # If your site was www.example.com/forum, the setting would be /forum/
    #RewriteBase /vbulletin/
    RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    RewriteRule ^ http://%1%{REQUEST_URI} [R=307,L]

The rest is default. I added that temporary rule to make sure to get rid of the www.

There is no .htaccess in the main directory.

[Wayne Luke]

Does the issue happen in a modern browser? Edge, Chrome, Firefox?

I recommend not using Internet Explorer. It hasn't been updated in 3 years now and is a dead browser.