New login session

[Naleksuh]

This was previously discussed in viewtopic.php?p=82164 but did not really have much to do with the Node library.

I have noticed that sessions have expired much more frequently now, I get logged out every couple of days even with the 3-month box ticked. Maybe that box just set the email and password cookies, and doesn't work with the token one?

[TimeX]

If I'm not mistaken, some (all?) users were forced logged out during an internal operation. That may have been what you saw. The 3-month login retention should still work otherwise.

[Naleksuh]

It's happened a few times not just once. Though I don't know if this was maintenance those other times as well. Does anyone know?

[Naleksuh]

Also still getting the logout error.

<a href="login_logout.pl?return=">Click here</a>

Why is this not working? It doesn't have http://

[Edge100x]

Is your browser string or IP address changing? These could cause your token to no longer validate.

If you're curious about the cookie lifetime, you should be able to check that through your browser's development tools.

login_logout.pl should be fixed to work around your https issue now. That http redirect is still something that was in place for years, so it doesn't relate to the recent login changes. Good to have adjusted, though.

[Naleksuh]

No, my IP address never changed. Is the "browser string" the user agent? If so that didn't change either.

[Edge100x]

Hmm. No reason that I can think of for it happening on this end, apart from what TimeX said. If I see it happen to me personally, I will be able to investigate further in depth.

[Naleksuh]

This has happened again. Even though the three-month box was checked when I logged in, I'm not logged in anymore.

Next time I open the control panel I will open the network tab first to see what my browser and NFO are doing

[Naleksuh]

This doesn't seem to have happened since. Might just be active ongoing work on the login system. Or it might be because of the client-side expiration differing from the server side. Does the backend expire session tokens or does it just rely on the cookie going away like it did with the password one?

Also, there is now a PHPSESSID cookie which I don't remember existing. Is that new? :O

[Naleksuh]

This happened again. Sadly, I did not have my browser tools open.

However, I did happen to notice the URL. Which was https://www.nfoservers.com/control/logi ... d%20needed - is this a clue?