user logged out after 24 hours

MartinJD

Hi folks. I have a user complaining that they are logged out every 24 hours, after which they get a load of errors saying they don't have persimmon to post (i''ve asked for the exact error next time it happens).

I've made sure they are ticking "remember me" when logging in. They are logging in from two devices, an iphone and a mac, both using safari.

I'm aware that "remember me" uses a cookie which means they shouldn't need to re auth their session, so i'm a bit stumped as to what exactly is going on here.

Could it be due to using two separate devices? or should this be supported?

tankerkiller125

If the screen is on the same display for 24 hours or the browser cache is storing the page they could be receiving errors to to the CSRF session expiring.

MartinJD

So say if the user has a tab open, one on each device. Are you saying that if one of the tabs is open but isn't used for 24 hours this would cause the issue?

tankerkiller125

That should not cause the issue, lets ignore that it happens on two devices for now. Lets just say it's one device.

If on that single device they have the page open for more than say 10-15 minutes the CSRF for that page will expire and they will be unable to post (but they won't be logged out).

Now lets say they open that page and then just leave. Their browser might cache that page for quick access next time. The problem with this however is that the CSRF token the browser also cached will be out of date within 10-15 minutes after the user first opened that page. So when they go to the page the second time and try to post (not knowing that the page was cached) they will receive a CSRF token error. (Also wont log them out)

If they are actually truly getting logged out though then it sounds like it could be either an extension issue or a server issue. However without more details from the user we won't be able to diagnose it.

MartinJD

tankerkiller125 If on that single device they have the page open for more than say 10-15 minutes the CSRF for that page will expire and they will be unable to post (but they won't be logged out).

is that the case? I thought that the "remember me" option would just basically keep you logged in at all times?

Edit: so in order to avoid this issue (assuming this is the cause) is the solution to tell users to shut their browser tab once they're done, and re-open it as and when they want to use the site?

tankerkiller125

MartinJD You will stay logged in, but you won't be able to post because of the CSRF token expiring. The CSRF token will ALWAYS expire after some time regardless of the remember me settings. Further the CSRF token changes every so often (can't remember when at the moment). You could create an extension to turn off CSRF but I would HIGHLY advise AGAINST doing so. CSRF tokens are a critical feature for security.

MartinJD

OK thanks, so just to be clear then, is it expected behaviour that a user will need to periodically log back in due to the CSRF token expiry? is so, how often is this?

tankerkiller125

MartinJD It's expected that they won't be able to post after some time sitting on the same page. They should not have to login (AKA they should not need to enter their password/username again) if you user does have to login (needs the username and password again) then their is something else going on.

MartinJD

So if they can't post after some time sitting on the same page, how would they fix this without having to log in again? just refresh the browser window? or use the refresh icon on the home page?

tankerkiller125

MartinJD If they refresh the page they should be able to post again without logging in again yes.

MartinJD

OK thanks! i'll ask the user to try this next time they get the errors....

MartinJD

hmm. I've actually experienced this for myself a couple of times now. I was logged in on two devices (iphone and mac) before i went went to bed. When i woke up in the morning, i got the errrors below then got logged out when i refreshed the page.

on my main page i got:
The requested resource was not found.

Each time i clicked on a thread I got:
You do not have permission to do that.

If I refresh the page in my browser I’m logged out.

I ran tail -f on
/flarum/storage/logs, and also the error log in apache. I’m not seeing any errors appearing in these logs that correspond with the errors popping up in the GUI.

How do i go about debugging this? This is now concerning me as we've just migrated over to flarum and this could be a deal breaker for the users.

askvortsov

Could you post the output of your php flarum info command? That might give us a bit more info to work with.

MartinJD

askvortsov Sure thing.

askvortsov

Have you tried disabling any of the 3rd party extensions and seeing if that solves it? Also, have you considered upgrading to beta 13? Can't say for sure that'd fix the issue though, I'd start by disabling 3rd party extensions and seeing if that narrows it down.

MartinJD

ah I wasn't aware of a new version.

The last plugins i installed where byobu, analytics & gamification. I guess i could turn them off but the users may wonder where the features went. Do you think it might be an issue with one of my plugging then?

Edit. Just ran a cheeky upgrade to beta 13 - all seems to have gone well so i'll see if this fixes it. Thanks for your help so far

MartinJD

hmm. Just had another user kicked out. 🙁

Should I turn debug mode on? Will turning it on effect the users?