Phantom guests!

[Falconeer]

Hello,

I have just taken over administration of a specialist car club forum hosted on SMF.  All our users gain access to our forum using their username/password and therefore appear as their chosen username.  However, down the bottom of the forum 'Home' page where you can see who is currently on the forum, it isn't unusual to see one or more 'Guests'.  The only additional information I can see is what they are looking at and their IP address.  Can anybody help me understand what is going on here?  Are people somehow able to get past the password protection and look at the forum anonymously?  There are no great secrets to be had, just lots of talk about oily widgets and alike, however I would like to understand what is going on as a part of getting to grips with being the Administrator. Thanks

[Kindred]

Well, first, it just means that they are looking at the URL...  It does not meant hat they are actually seeing anything that the URL.

However, do you actually have your system closed to guests, completely?

[Falconeer]

Thanks for your reply Kindred.  Our car forum was set up by others (I have just recently taken over as Administrator) and it is a closed forum.  Any member wanting access has to create a username and be given a password.  You say these guest are only looking at a URL but not actually seeing anything.  I could understand this if all that appeared against the guest activity was the log in page, but you can see from the attached screenshot that these guests appear to be looking at topic boards within our forum.  I would be grateful of any more thoughts?

[Illori]

same thing applies, if you browse to that url as a guest and get a log in screen, then that is all they are seeing. since you can see the topics etc you see the name of them listed but the guest does not.

[Kobytoo]

Do you have many login failures? By this I mean do you often need to login more than once on some occasions when at other times login works perfectly.

[Falconeer]

Thanks for your replies Illori and Kobytoo.  I think I'm beginning to get the picture here.  We suffer from genuine log in failures (i.e. where username and password is entered correctly), however, on closer inspection I see that login session timeout seems to bounce you back to 'guest' status. 

Would it be correct to assume that anyone who opts to login on the default of 60mins time-out will appear as 'guest' status after 60 minutes and still appear to be looking at the last topic they were on? (Even though, due to the time-out, they cannot see anything until they log in again.)

[Illori]

if they were logged in, you will see them as logged in until the timeout for active users in the who's online list. if they try to browse to a topic etc after that 1 hour limit expires for them to be logged in then they will show up as a guest and not able to see the page until they log in.

[Kobytoo]

I asked because I too have these phantom guests and have put it down to issues with users, who use the correct username and password, getting told they are using the incorrect credentials. Incidentally, I believe this is caused by the presence of certain characters in the session ID. At least, that is what I appear to have found.

[Illori]

please open a separate topic for your issue, you are just going to confuse those trying to help and the user asking for help.

[Kindred]

Falconeer -- just because they are looking at a URL does not mean that they are actually SEEING the page.

The who's online list shows a list of what URLs people are attempting to view. period.
it does not show if they actually see the contents or if they see a login screen....   it just shows that they are viewing that URL.

For example...
if I visited your site with action=admin
it would show "Guest viewing the admin screen"
I'm not actually SEEING the admin screen...  all *I* see is a login box....   but the system sees the URL and reports what page I am trying to view based on that.


In other words.... there is no problem with your site.

[Falconeer]

OK , I now understand!  Thank you everyone, particularly Kindred for the last explanation about the how the 'action' in the URL becomes reflected in the 'who's online list'.  This is my first experience of using the forum for help and it has work well, so thanks again.