[Bug / Issue] MY VB Site Logs Me Out

[panzerscope]

VB Version 5.5.1
PHP Version 7.2.12
MySQL Version 5.6.41-cll-lve


Hello all,

So one would first make the assumption that I need to adjust my session timeout settings in AdminCP, this is something I have already done and I have set it for now at 2 hours before the session times out.

Unfortunately however my site at random times decides to log me out. I have disabled any additional plugins/products that I have added to my site to make sure they were not a factor, alas it made no difference and I am still being logged out. The only way the site will keep me logged in is by clicking the ''Remember me'' checkbox when logging in. Not all users are going to want to use that and it seems silly to use that to stay logged in for any meaningful amount of time.

I can only assume there is an issue somewhere as there logging out is sporadic. I have made sure to use a vanilla browser (Chrome/FF) for testing to make sure there are no add-ons interfering but again that makes not difference.

I have a video linked below showing an example of the sporadic issue. You will notice I click on my username drop down and select ''My Profile'' which then proceeds to log me out. The annoying thing is, once I re-login, I cannot duplicate this issue again as going back into My Profile a second time will result in normal behavior rather than logging me out, again it is sporadic and not something that can always be duplicated by copying any specific steps. Oddly, I have had this issue when attempting to play the embedded YT video on my sites homepage, this is why you see me in the video you see me going to play it...but on this occasion it did not log me out.

Video: https://drive.google.com/file/d/1yiN...ew?usp=sharing

This one is super irritating and it happens on an user account I have created, whether full admin or a registered user.

Any ideas ?

Happy to provide any information you need.

Thanks,
P

[Wayne Luke]

Your login status relies on cookies stored by the browser on your device. Logins will not be shared across devices or browsers. Logging out on one device will not log you out of others.

You can be logged out if -

1. You block cookies from the server.
2. Cookies are deleted from the device,
3. The cookie prefix in the /config.php and /core/includes/config.php files don't match,
4. You have not selected "Remember Me" on the front-end and your site is behind a proxy (i.e. Cloudflare) and the reported IP Address changes.
5. If you are inactive longer than the Cookie Timeout value and you have not clicked "Remember Me". This is 15 minutes on a default server.
6. After one hour of inactivity in the AdminCP unless you have the "AdminCP Timeout" value set to yes, then it matches the Cookie Timeout value.
7. You block JavaScript for any reason.

You will be logged out if:

1. Logging out on the front end will log you out of the AdminCP.
2. When you change the cookie prefixes in the configuration files.
3. Your site is configured to be at one domain and you access it from another domain or sub-domain. This includes going from HTTP to HTTPS and using www.domain.com vs. domain.com.

The video quality is too low to determine anything that might be causing your issue.

[panzerscope]

Hey Wayne,

Thanks for the response. Sorry about the video quality, was only meant to show you the random logging out. Thanks for the list of things that can cause the logging out. I will have to look into the above and see what could be doing it. Looking at the list I can only make an educated guess that it is the Cookie prefix...possibly as the others I have already accounted for when testing and I am not behind cloudflare.

Thanks once again !

[glennrocksvb]

You can be logged out if -[LIST=1][*]You have not selected "Remember Me" on the front-end and your site is behind a proxy (i.e. Cloudflare) and the reported IP Address changes.

Wayne Luke, should this still happen even if you set $config['Misc']['proxyipheader'] and $config['Misc']['proxyiplist'] in the config and you confirmed that the IP vBulletin is getting is the real user IP and not the Cloudflare IP?

[Wayne Luke]

Should this still happen even if you set $config['Misc']['proxyipheader'] and $config['Misc']['proxyiplist'] in the config and you confirmed that the IP vBulletin is getting is the real user IP and not the Cloudflare IP?

If the proper headers are being set, then it shouldn't happen.