Session verification failed When Trying to Logout or Administer Forums

[ProNotion]

We are attempting to bring a new installation of SMF online after recommendation from an existing user. We had issues getting the software running on our Windows Server so have built a new Linux based server and installed SMF on there with little success it would seem. The server is hosting only SMF and I have been assured meets all of the SMF minimum system requirements.

We can login fine but are currently unable to logout of the forums or able to access any of the administration pages due to the error "Session verification failed. Please try logging out and back in again, and then try again.". When attempting to access an admin page like "Features and Options" we are presented with a password field which when completed returns the previously mentioned error. The same happens when trying to logout and as a result are never able to logout without manually removing cookies from our machines.

This may or may not be related but we can also not see CAPTCHA images and therefore cannot signup new members either. GD Library is installed.

A link to a PHP_INFO file can be provided on request by means of a direct message.

Thanks in advance for any help.

Simon

[ProNotion]

Strangely if I view the source of one of the images in the captcha output I don't get any sort of error e.g. /index.php?action=verificationcode;vid=register;rand=540d5a6bced96814a2a2075f2150f9e6 - Output is just blank.

[Sir Osis of Liver]

See if you can logout after deleting cookies.

[ProNotion]

Not sure how you could even do that since removing the cookies logs you out anyway?

[ProNotion]

Any chance of any help on the issue this morning please? I have a couple of hours before I am being told I need to find an alternative forum solution since this has now been tried on two servers and failed to work and due to limited support options with this software my employers are now considering alternative solutions.

Personally I would prefer to stick with it but as always time is not on my side.

Thanks, Simon

[Sir Osis of Liver]

This problem has occurred on quite a few forums, but all the ones I've looked at have been affected differently.  Been unable to duplicate it in 2.0, 2.0.1, or 2.0.2.  Seems to be a cookie problem, possibly related to server setup or php config, but haven't been able to pin it down.  If you're willing to put more time into it, try installing 2.0,  upgrade to 2.0.1, then to 2.0.2, and see where the problem first shows up.  I worked on this for a couple of weeks, but without being able to duplicate the problem, not much I can do to help.

[ProNotion]

Thanks for responding Krash, I appreciate your time but in this life there is only so much time I can afford to spend on trying to make something work that doesn't for some reason want to work out of the box which doesn't fill me with confidence once the site moves into a live environment.

We have decided to implement another solution now that integrates better with our existing infrastructure which is Windows  based.

Thanks for your time.

[zg4me]

This problem has occurred on quite a few forums, but all the ones I've looked at have been affected differently.  Been unable to duplicate it in 2.0, 2.0.1, or 2.0.2.  Seems to be a cookie problem, possibly related to server setup or php config, but haven't been able to pin it down. ...

Here's something that may help, or may not.

I run two servers. One production (Win2008 Web), and one demo on a private subnet (Win 2k Server). Both have identical PHP/MySQL/SMF 2.0.2, but the private test server has a few test mods installed (and a few files leftover from uninstalls).

Production server works fine, even today. Demo server just started the "session verification failed" error. No mods or core updates installed in ? ? ? weeks, either server. This may be related to:

I replaced my main workstation last week w/ a new Win7 box. I also nuked/reinstalled XP on my laptop a week ago. My Win7 box has IE 9 and FF 10.0.2, the latter my preferred browser BTW Laptop has IE8 only.

I can RDP to both servers (duh). The demo server works fine in an RDP session, so does the production, but I have few occasions to do so on the production server.

Cleared cookies, cleared cache, renamed cookie, deleted DNS on the laptop, turned off proxy on laptop; no joy.

If I can help...

Rick

[Sir Osis of Liver]

That's the really odd thing about it - the problem often occurs for no apparent reason on forums that had been running fine.  Had a theory early on that the sessions were somehow being affected by third party cookies, and was able to fix one forum by eliminating an external link that dropped a tpc, but that turned out to be a one-off. 

I run IE8 in XP Pro SP3, with blocks, filters, and a privacy app that removes all but a few whitelisted cookies when I shut down, but am still being tracked.  It's possible that at some point a tracking widget is added to a forum by one of the many dataminers that plague the net, and it causes the session errors, but I can't confirm this.

[zg4me]

More info... Putzed around on Google today, [tried to] grok the PHP manual, etc. 

If I disable administration security, either via a browser on the demo server or via HeidiSQL on my workstation, all is well in the world. No session failed error when I 'switch' to admin mode. As to what I'd be looking to fix/hack in the php scripts, nary a clue.

Rick

[Sir Osis of Liver]

That's interesting.  I have admin security disabled on all of my 2.0 installs, which may be why I can't duplicate the problem.  Will have to tinker with that.