"TokenMismatchException" when trying to log out.

caustic

Not sure what happened as it was working just fine previously but for some reason logging out no longer works as expected, it's the only thing that seems to have gone amiss.

Here is the contents of the page I receive

Flarum\Http\Exception\TokenMismatchException thrown with message ""

Stacktrace:
#30 Flarum\Http\Exception\TokenMismatchException in /usr/share/nginx/WEBSITE.space/html/vendor/flarum/core/src/Forum/Controller/LogOutController.php:75
#29 Flarum\Forum\Controller\LogOutController:handle in /usr/share/nginx/WEBSITE.space/html/vendor/flarum/core/src/Http/Handler/ControllerRouteHandler.php:52
#28 Flarum\Http\Handler\ControllerRouteHandler:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/flarum/core/src/Http/Middleware/DispatchRoute.php:71
#27 Flarum\Http\Middleware\DispatchRoute:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Dispatch.php:224
#26 Zend\Stratigility\Dispatch:dispatchCallableMiddleware in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Dispatch.php:88
#25 Zend\Stratigility\Dispatch:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Next.php:160
#24 Zend\Stratigility\Next:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/flarum/core/src/Http/Middleware/SetLocale.php:50
#23 Flarum\Http\Middleware\SetLocale:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Dispatch.php:224
#22 Zend\Stratigility\Dispatch:dispatchCallableMiddleware in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Dispatch.php:88
#21 Zend\Stratigility\Dispatch:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Next.php:160
#20 Zend\Stratigility\Next:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/flarum/core/src/Http/Middleware/AuthenticateWithSession.php:33
#19 Flarum\Http\Middleware\AuthenticateWithSession:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Dispatch.php:224
#18 Zend\Stratigility\Dispatch:dispatchCallableMiddleware in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Dispatch.php:88
#17 Zend\Stratigility\Dispatch:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Next.php:160
#16 Zend\Stratigility\Next:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/flarum/core/src/Http/Middleware/RememberFromCookie.php:38
#15 Flarum\Http\Middleware\RememberFromCookie:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Dispatch.php:224
#14 Zend\Stratigility\Dispatch:dispatchCallableMiddleware in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Dispatch.php:88
#13 Zend\Stratigility\Dispatch:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Next.php:160
#12 Zend\Stratigility\Next:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/flarum/core/src/Http/Middleware/StartSession.php:33
#11 Flarum\Http\Middleware\StartSession:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Dispatch.php:224
#10 Zend\Stratigility\Dispatch:dispatchCallableMiddleware in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Dispatch.php:88
#9 Zend\Stratigility\Dispatch:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Next.php:160
#8 Zend\Stratigility\Next:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/flarum/core/src/Http/Middleware/ParseJsonBody.php:30
#7 Flarum\Http\Middleware\ParseJsonBody:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Dispatch.php:224
#6 Zend\Stratigility\Dispatch:dispatchCallableMiddleware in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Dispatch.php:88
#5 Zend\Stratigility\Dispatch:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/Next.php:160
#4 Zend\Stratigility\Next:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-stratigility/src/MiddlewarePipe.php:111
#3 Zend\Stratigility\MiddlewarePipe:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/flarum/core/src/Http/AbstractServer.php:53
#2 Flarum\Http\AbstractServer:__invoke in /usr/share/nginx/WEBSITE.space/html/vendor/zendframework/zend-diactoros/src/Server.php:166
#1 Zend\Diactoros\Server:listen in /usr/share/nginx/WEBSITE.space/html/vendor/flarum/core/src/Http/AbstractServer.php:34
#0 Flarum\Http\AbstractServer:listen in /usr/share/nginx/WEBSITE.space/html/index.php:16

Environment & details:

GET Data
token	5tyKKytTf9Y6gt4ZNR7Z7RS6kfO6UUaRyd3Pavb3
POST Data empty
Files empty
Cookies
__cfduid	deb3587e9732ae48635e10d11f11faf551480830285
_ga	GA1.2.782962848.1480571216
flarum_remember	A6eIS4Hn82XZeijOpD665QRTOqIS7GJfLvhTXhhx
flarum_session	tlig0rfpfqigm7fmpjdire4pg3
Session
_sf2_attributes	Array ( [csrf_token] => aTih15NaEyckqpgUt6k7DCExx3NTufn18JG565IL [user_id] => 1 )
_sf2_flashes	Array ( )
_sf2_meta	Array ( [u] => 1490434406 [c] => 1490434406 [l] => 0 )
Server/Request Data
USER	www-data
HOME	/var/www
HTTP_COOKIE	__cfduid=deb3587e9732ae48635e10d11f11faf551480830285; _ga=GA1.2.782962848.1480571216; flarum_remember=A6eIS4Hn82XZeijOpD665QRTOqIS7GJfLvhTXhhx; flarum_session=tlig0rfpfqigm7fmpjdire4pg3
HTTP_ACCEPT_LANGUAGE	en-US,en;q=0.8
HTTP_ACCEPT_ENCODING	gzip, deflate, sdch, br
HTTP_REFERER	https://WEBSITE.space/
HTTP_ACCEPT	text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
HTTP_USER_AGENT	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
HTTP_UPGRADE_INSECURE_REQUESTS	1
HTTP_HOST	WEBSITE.space
SCRIPT_FILENAME	/usr/share/nginx/WEBSITE.space/html/index.php
REDIRECT_STATUS	200
SERVER_NAME	WEBSITE.space
SERVER_PORT	443
SERVER_ADDR	2a01:4f8:(omitted)
REMOTE_PORT	60239
REMOTE_ADDR	2604:6000:(omitted)
SERVER_SOFTWARE	nginx/1.11.11
GATEWAY_INTERFACE	CGI/1.1
HTTPS	on
REQUEST_SCHEME	https
SERVER_PROTOCOL	HTTP/2.0
DOCUMENT_ROOT	/usr/share/nginx/WEBSITE.space/html
DOCUMENT_URI	/index.php
REQUEST_URI	/logout?token=5tyKKytTf9Y6gt4ZNR7Z7RS6kfO6UUaRyd3Pavb3
SCRIPT_NAME	/index.php
CONTENT_LENGTH	
CONTENT_TYPE	
REQUEST_METHOD	GET
QUERY_STRING	token=5tyKKytTf9Y6gt4ZNR7Z7RS6kfO6UUaRyd3Pavb3
FCGI_ROLE	RESPONDER
PHP_SELF	/index.php
REQUEST_TIME_FLOAT	1490434406.4466
REQUEST_TIME	1490434406
Environment Variables empty
Registered Handlers
0. Whoops\Handler\PrettyPageHandler

I tried to copy this in a way that was easy to look at without literally posting a full screenshot...I failed.
I went ahead and tried to find out why it has done this but so far I haven't found anything.

Is this something that's worth troubleshooting or should I just back up the bits and boobles of the database and burn it?
Thanks.

clarkwinkelmann

The same error has been reported to me yesterday by a user of my flarum install.

It must have something to do with the CRSF token.

Be careful, you should not share your cookie content if the website was online, because anybody could hijack your session ? In this case I don't think it's an issue because it's your local setup.

caustic

clarkwinkelmann
How strange, I wonder if this is actually a Flarum issue or just coincidence/a fluke.
It does affect all users in my install...

Yeah, I figured that lol.
I removed all references to my site and IP addresses and removed the session from the database. So no worries there at the very least. This is actually a public/production Flarum install which I know I'm not supposed to do but no one follows that rule. ?

clarkwinkelmann

caustic do you know that's the session.gc_maxlifetime value in your php.ini ? Maybe try to increase it so sessions don't get removed from the disk too quickly.

I'm not sure if session duration is set by Flarum elsewhere or not

clarkwinkelmann

I think I've found the explanation.

Your session timeouts in the background while Flarum is still open in your browser and only know the old CSRF value. Because you have a "remember me" cookie set (in Flarum beta 6 you can't opt out of remember me), the logout request will try to restore your session before actually performing the logout. This result in Flarum creating a new CSRF token, which is different from the one sent by the application.

If you don't have a "remember me" cookie there is no issue, because the logout request does not try to restore your previous session.

How to reproduce:

Login into Flarum
Run the following code in a new tab to simulate session timeout (or wait a very long time and try to trigger PHP session garbage collector, which is not the easiest task):

<?php

session_name('flarum_session');
session_start();
session_destroy();

Click "log out" in Flarum tab. You will run into a TokenMismatchException
If you manually remove the flarum_remember cookie before logout, there is no error

In dev-master there is a checkbox to select "remember me". Trying the above code result in a lot of PHP warnings due to undefined variables. That's probably due to some work in progress.

I have no idea how this should be handled. That's sort of the expected behavior ?

caustic

clarkwinkelmann The current value is 1440.

Maybe it could be a permissions issue with the sessions folder? I did have to change it for another site I was running to work properly. I ended up changing the owner to nginx:nginx which should of been fine though.
edit: I tried setting it back to nobody:nogroup to no effect so I left it at nginx:nginx.

(very late update, been fixed for months)
The folder permissions were messed up by an unrelated package. I had to manually set them back one at a time including the sub folders. But after that it was fixed. Wasn't too obvious but I'm glad I figured it out eventually.