error: Unable to verify referring url. Please go back and try again.

[brynn]

Hi Friends,
I was having trouble with this error message, primarily in my SMF forum which uses Simple Portal (Inkscape for Cutting Design, see my signature for a link), and a little bit in my other forum (Inkscape Community) which is using Tiny Portal.  Here's where we worked on it, and after watching my error log for a week to 10 days, and not seeing the error any more, I thought it was fixed.  https://www.simplemachines.org/community/index.php?topic=560898.0

Note that at that time, I upgraded the portal mods in both forums, and also applied this login fix to all themes.  As I said, it appeared as though it was fixed, at that time.  I don't know exactly when the errors started happening again.

But now, I'm seeing the error again, but this time primarily in Inkscape Community.  I have 5 pages of this error over a month's time.

hppps://forum.inkscapecommunity.com/index.php?action=login2  (messed up link on purpose)
Unable to verify referring url. Please go back and try again.

I also see the error in Inkscape for Cutting Design, but not nearly as much (about 1 page over a month).

At first, I thought this was the same problem which had returned, and posted in the Tiny Portal forum, since I'm having more errors from the forum which uses TP.  There they suggested I might be having this problem:  https://www.simplemachines.org/community/index.php?topic=562154.0

I'm not sure if I understand completely the implications.  The part I don't understand, is if it's just some random guests or bots trying to log in, why should that trip an SMF error?  I can see maybe SMF would give them a message that they need to be registered before they can log in, or something like that.  But why should it give an error?  (And specifically, why the error that the referring url is blocked?)  Besides, wouldn't every SMF forum be getting tons and tons of this error, if just any random website surfer is trying to log in?

Note that I have not confirmed whether the people hitting this error are actual members who are trying to log in.  However, I have not had any complaints from members.

They (in the TP forum) also suggested maybe random bots were clicking on the links from that older topic.  But those links are going to the forum which now is having the least errors.  I don't think I posted any link from the error, from the forum which is now having the most errors.  (Although I have not reviewed the old topic to be sure, I have posted other error messages in other topics, and I'm not getting lots and lots of those error messages being hit on repeatedly.)

And also in the TP forum, they reminded me about the login fix, and eventually I confirmed that I had already applied all the available fixes.  So now I think I'll get even more experts looking into it, if I post here again.

I'm not sure what kind of info you might need.  I have approx 40 mods in Inkscape Community, and I guess approx 35 in Inkscape for Cutting Design.  I can post lists (with version #s) if you need to see them.  Both forums running version 2.0.15.

Sorry for the long history.  Does anyone have any ideas where this error might be coming from,  or how I can fix it?

Thank you very much 

[Sir Osis of Liver]

Those errors are typically caused by bots, don't remember why.  Older, busier forums tend to have a lot of them.  If you do ip lookups, most will be from russia or china.  Unfortunately, there's no easy way to disable user errors (this has been discussed).  You can use a shorter setting for log pruning if your error log is getting too large.

[brynn]

My forum isn't old or busy.  I started it 5 years ago, and we now have 1750 members.  I'd estimate that these errors are accounting for 75% of all our errors.

What I don't understand, is why this is even an error.  If these visitors are not members, why should it trip an error when they are unable to log in?

I'm not sure about pruning the error log.  Doesn't that mean deleteing errors without looking at them?  Although looking at those settings, I'm not sure if it's working.  I see that mine is set for 30 days, but I have entries in the log older than 30 days.

Thanks again

[Looking]

Bots trying to do things they should not can cause errors to be logged.  How far back does your logs go?

[Sir Osis of Liver]

What I don't understand, is why this is even an error.  If these visitors are not members, why should it trip an error when they are unable to log in?

This is something that's been discussed, but afaik, nothing's been done in development to address these useless errors.

I'm not sure about pruning the error log.  Doesn't that mean deleteing errors without looking at them?

Basically yes, but if your forum is running ok, it's really not necessary to see errors that occur infrequently and aren't causing problems.  I've worked on a couple of forums that had gigabyte error logs (7-8m errors), not very useful (too much information), and made it difficult to backup and work with database.  You shouldn't have any errors in log that predate pruning setting.

[brynn]

Bots trying to do things they should not can cause errors to be logged.  How far back does your logs go?

These errors going back to Oct 24, 2018.  I know there were some before that, but I deleted because I didn't want to deal with figuring out why they were happening again.

I guess by that date, it means that the pruning is happening correctly.  But to be honest, I never really looked into pruning before.  I didn't know it was happening.  At least if nothing else comes from reporting this, I learned something, haha.

This is something that's been discussed, but afaik, nothing's been done in development to address these useless errors.

I'm not sure if you mean that there are other errors like this, which shouldn't be happening at all.  Or if you mean just this error.

Is there anything I can do, to bring this to the attention of developers?  This is really too many errors, for me, especially since they shouldn't be errors at all.  Would this be considered a bug?

[Aleksi "Lex" Kilpinen]

What I don't understand, is why this is even an error.  If these visitors are not members, why should it trip an error when they are unable to log in?

This is something that's been discussed, but afaik, nothing's been done in development to address these useless errors.

I do not think those are useless at all, they are not necessarily "errors" as in something to be fixed, but they can be "errors" as in something to keep an eye on. However, if your activity is normal, and you don't hear complains of problems logging in - I'd say they are not much to worry about.

[Sir Osis of Liver]

It's not so much that the errors are useless, but they can cause unnecessary concern, as in this case, or more often cause forum owners to ignore error log when it's flooded with user errors, which is worse.  There was a recent thread about this, and some suggestions were made re: handling user errors differently (can't find it).

[Aleksi "Lex" Kilpinen]

Yeah, I know it's been a matter of debate (at least in 2.1) and I also agree we could probably handle them better.

[brynn]

To me, these "errors" should not be in the same place where an admin is looking for serious problems which indicate that something is broken.  They should be separated, so that I don't have to sort through what is only going to become massive numbers of entries, just to make sure that nothing is broken.

Is there any way I can add my support to the issue?  I'd like to give feedback to developers.  I just don't know how this community handles it.

Thanks again!

PS - Looking at my error log, I just realized how many apparently meaningless errors which I constantly delete.  Would it be helpful to bring this to the attention of developers, by posting a message which lists all these errors?  Or would such a post just be considered noise?

Really,  my goal is to be helpful.  Please let me know the best way to do that, regarding all these error messages.

Thanks again!

[Arantor]

Certainly it would not be noise. However, it would need time and skill to sift out whether errors are mod related or not.