Member error problems logging in..

[justuk]

A user who previously had no issue logging in..now cannot...this is the message she gets..

The following error or errors occurred while posting this message:
Your session timed out while posting. Please try to re-submit your message.


Now..these are my forums cookie settings,

cookie name...smf2

Default login cookie length..60 minutes

Enable local storage of cookies...YES

Use subdomain independent cookies..YES

Force cookies to be secure..YES.  (am using HTTPS)

use basic cookie authentication...NO

Use database driven sessions..NO

allow browsers to go back to cached sessions...YES

seconds before unused sessions timeout....2880

Any ideas please? Yes my second in command Skyon Archer does all the techy stuff,bless him..but I must learn some things myself...so...how to fix this?

Silly question...would it make a difference if I reverted to the standard SMF theme? I read about that somewhere...

help appreciated...thanks

[Kindred]

Did you change or update anything recently?

And, no, if you are running 2.0.19, theme should not matter

[justuk]

Nope...the only thing that was done is in the CSS for search engines..that shouldn't affect anything..never has before...it's just the last couple of days this has started happening..

[Steve]

Hi justuk! I also had the same problem at Friendly Chatting ... is that the site she's having trouble on or one of the ones in your sig? If at Friendly Chatting make sure she has cleared her cache and removed the cookies for that site in her browswer and did a hard refresh. You could always ask John what he did and show you how to do it. You still learn that way.

Then come back and let us know if you're still having problems. Or we can figure out what's going on here. Whichever you prefer.

[justuk]

Hey Steve..

Yes its my site..she said she cleared cookies etc..no joy..

[Steve]

I may have be editing my post when you posted.

At any rate, how did she clear her cookies? I had to go into my browser settings and actually clear the cookies for your site manually. Just doing it by going to History -> Clear recent history didn't do it for me for some reason. And the cache MUST be cleared and a hard refresh done.

I personally cleared the cache, removed the cookies, closed the browser and then reopened it, and finally did a hard refresh.

[justuk]

Now Skyon is having trouble,,had to change browsers..I dont understand why, all of a sudden there are problems with people logging in..out..posting..getting times out,,fed up,,annoyed,,baffled,,,any more suggestions?

[Illori]

if many people are having issues. maybe due to some mods you are using. might not hurt to do a backup and install fresh files for a while and see if the issues go away.
https://wiki.simplemachines.org/smf/How_to_upload_a_fresh_set_of_files

[justuk]

These issues only started a couple of days ago..way after any mods were installed..
No idea any more.... 

[Steve]

These issues only started a couple of days ago..

Was that right after Skyon made the changes he made to the cookies and sessions?

Edit: after reading Zandra's issues, Illori's suggestion may well be a good one. It doesn't look like you have a lot of mods or themes installed so it wouldn't be too much work to get it back in working order with a fresh set of files.

[xxxjackzxxx]

Use database driven sessions..NO

Try to turn this ON, actually.

[justuk]

You cannot view this attachment.

Now another user is getting this, For info the cookie/server settings are now set to the default SMF settings,,,

[xxxjackzxxx]

Change cookie name. If you switched to database driven let's start from scratch with new cookies for everyone and see if it still happens. It will require everyone to login again the moment you change the cookie name.

[Skyon Archer]

Cookies and Sessions
Cookie Name: just changed
Default login cookies length (in minutes): 60
Enable local storage of cookies: CHECKED
Use subdomain independent cookies: ___
Force cookies to be secure: ____
Use basic cookie authentication: ____
Use database driven sessions: CHECKED
Allow browsers to go back to cached pages: CHECKED
Seconds before an unused session timeout: 2880

[Steve]

And yet the problem persists. Just tried 4 different browsers (one of which I've never used to go to this site before) ... cleared cache, cookies and even disabled my security addons temporarily. I'm at a loss. Will see if I can get one of the gurus to look at this.

[Aleksi "Lex" Kilpinen]

One thing you could actually test is what justuk suggested already in the first post - Test things out with the default theme, does this have any effect on the issue? Since the session and cookie settings don't seem to have much impact, this might be worth looking in to. ( I'm assuming there isn't any http/https or www/non-www conflicts anywhere in settings? )

[justuk]

And yet the problem persists. Just tried 4 different browsers (one of which I've never used to go to this site before) ... cleared cache, cookies and even disabled my security addons temporarily. I'm at a loss. Will see if I can get one of the gurus to look at this.

😡😡😡. Steve I cannot apologise enough. I am as baffled as you..and Skyon. Can you actually post? Is it the time out message you're still getting? I have had that  but I just click post again and all is well. 

I'll mention using  the default theme to Skyon...why that should make a difference I have no idea..however anything is worth a try at this point...thanks for all your patience, suggestions and help..it is appreciated.  🙂

[Skyon Archer]

Steve, I see your theme setting is the Default Theme - Curve.  Is there still an issue?

I, personally, have seen no issues remaining logged in and/or getting a session error when posting so I can't replicate the issue.

[xxxjackzxxx]

I'll mention using  the default theme to Skyon...why that should make a difference I have no idea..

Just to clarify this, at some point one of the SMF updates for the 2.0 branch included a login change that broke some custom theme login forms. This doesn't seem to be the case because it seems to be working on and off so to speak, but it's possibly to rule that out as well.
I'm kind of at a loss too, never seen this before.

[Illori]

I'll mention using  the default theme to Skyon...why that should make a difference I have no idea..

Just to clarify this, at some point one of the SMF updates for the 2.0 branch included a login change that broke some custom theme login forms. This doesn't seem to be the case because it seems to be working on and off so to speak, but it's possibly to rule that out as well.
I'm kind of at a loss too, never seen this before.

there was a fix applied that makes that login form work on all themes no matter if they have the manual fix or not.

[Sir Osis of Liver]

I'm assuming there isn't any http/https or www/non-www conflicts anywhere in settings?

Have you run repair_settings?  If you haven't changed anything your host may have changed something.

[justuk]

Yes..ran repair..no problems found...

[Aleksi "Lex" Kilpinen]

This is a difficult one to diagnose, especially since you say that not everyone is seeing this problem.
If it was directly related to some single setting, it would be likely to be apparent to everyone.

[justuk]

Well both myself and Skyon have done all we can. As far as we can see there is NOTHING wrong with the forum..settings wise or anything else. I'll mark this as solved now. No point keeping on with it,

[Aleksi "Lex" Kilpinen]

One more thing I can suggest, empty out the forum's file cache, and ask anyone having trouble logging or posting to empty their browser's cache and do a hard refresh on the forum ( That's ctrl+F5 on most browsers I think ). May make a difference, may not.

[justuk]

I can promise you that has been done...EVERYTHING that can be done has been done.
Users have emptied caches and cookies and God knows what. So if anyone has a problem now..it has to be on their side I'm afraid. There is nothing wrong with the forum or the settings...and most certainly NOT my hosting provider whose link is in my siggy..and is owned by @Skyon Archer who I trust IMPLICITLY.

[Steve]

It's not really solved Jane. I switched themes and I now have no problems. There is something wrong with the default Curve theme.

[Aleksi "Lex" Kilpinen]

That narrows it down, can you reproduce the issue by switching the theme again?
If it's clearly linked to the theme, then we know we have a clear clue where to look at.

[Steve]

Okay, I just switched back and had the problem again. Switching to another theme after that and the problem goes away.

[Arantor]

Where exactly are you logging in once you are on Curve?

[Steve]

On the login page. She doesn't have a login box anywhere else.

[Arantor]

Then I have no idea which site you're talking about; the one in the user's signature shows a quick login box in the top left on Curve.

[Sir Osis of Liver]

Are we talking about https://friendlychatting.co.uk/smf_2/ ?

[justuk]

Then I have no idea which site you're talking about; the one in the user's signature shows a quick login box in the top left on Curve.

Eh? My site..the one in my siggy? what site did you think I was talking about?
The first page you see is a 'landing page' simply click the large 'lets chat' button and enter the site.. 

[justuk]

Are we talking about https://friendlychatting.co.uk/smf_2/ ?

Of course we are...what did you think I was talking about? 

[Aleksi "Lex" Kilpinen]

There are 3 themes installed, theme=1 and theme=3 seem to have some validation issues with a .js added on to them, theme=2 seems to validate without errors. Does the login issue correlate with this, or which theme was it that had no issues?

[Steve]

Theme 1 which is the default Curve theme is the one I'm having troubles with.

(and be nice Jane  )

[justuk]

Theme 1 which is the default Curve theme is the one I'm having troubles with.

(and be nice Jane  )

Excuse me? 

[Sir Osis of Liver]

Registered as Krash, boot me up.

[justuk]

Registered as Krash, boot me up.

Ohhhh it's you! All approved..welcome to Friendly Chatting,, 

[Sir Osis of Liver]

Just time for a quick look, two things:

- No problems logging in or posting, different browsers, different IPs.

- https://friendlychatting.co.uk/smf_2/ works fine, https://www.friendlychatting.co.uk/smf_2/ is blocked by Kaspersky due to invalid certificate.  Are you forcing www to non-www?  Can you or your host check your certs?

Back on tonight.  Gotta run .........

[Sir Osis of Liver]

Wow, what a mess.  I get this:

theme=1 quick reply > theme=3 login
theme=1 reply > theme=3 login

theme=2 quick reply > posts - logs out, shows logged
theme=2 reply  > posts - remains logged

theme=3 quick reply > posts
theme=3 reply > posts

If I login to Curve, reply takes me to theme 3 post editor and can post. 

- What's in your .htaccess? 

- Are you using a Let's Ecrypt cert?

Also seems to have affected my browser, got a token error trying to login here.

[justuk]

Are you suggesting my hosting providers SSL is at fault here? And that my site is somehow unsafe? (unless I've misunderstood)

Right...I changed my theme to SMF default CORE theme... couldn't post.. changed it to CORE..same thing,,
Changed it BACK to our board default Jane...works.  Something in those two themes is causing problems..
Even after I cleared my cache it made no difference. Now all my users are using the jane theme..no problems

[Sir Osis of Liver]

Never seen this before, but kind of feels like a caching issue.  Curve bounces me back to theme 3 login, it drops the session when attempting to reply.  Core drops session, but continues to show user logged.  Have you tried clearing forum cache and disabling caching?  Is server running any caching?  What's in your .htaccess?

The certificate warning is most likely caused by not having the cert configured for www as well as non-www.  If you're using cpanel, you can check that in SSL/TLS Status.  That would cause problems for users who have old www bookmark.  Shouldn't have anything to do with the theme problem, but anything's possible (especially if it's bad).  You are using a Let's Encrypt cert, they made a change in Sept that caused problems for my forums, but nothing like this -

  https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

Your cert may have renewed recently and updated to newer version, that might explain why the glitch appeared from nowhere.  My host fixed it by switching to a cpanel cert.

[justuk]

Are you suggesting my hosting providers SSL is at fault here? And that my site is somehow unsafe? (unless I've misunderstood)

Right...I changed my theme to SMF default CORE theme... couldn't post.. changed it to CURVE same thing,,
Changed it BACK to our board default Jane...works.  Something in those two themes is causing problems..
Even after I cleared my cache it made no difference. Now all my users are using the jane theme..no problems

[Kindred]

justuk -- you're reacting, not reading ---     

Your certificate is either not configured correctly for your setup
-- You need to have a certificate set up for the ROOT domain (which includes all subdomains) *OR* you need to have a certificate set up for each and every subdomain -- and www is a subdomain.
OR
-- You need to configure your .htaccess to properly FORCE everyone into both https AND the subdomain that you expect your forum to use (either www or not www)

ONE of those things should happen....  it's up to you which one (although I would suggest the second)

Core is ancient, outdated and probably does not properly support some things....    honestly, unless you have someone willing to spend the time to debug, I would suggest just deleting the core theme entirely.

Curve is the default theme for SMF 2.0...   it's also the fall-back. If a custom theme does not have custom files defined, then the system uses the Curve (aka default) version of those files.  If Curve is failing, but your custom theme works -- that's great, your system can work for your users -- but you should figure out why Curve fails.

or, maybe, upgrade to 2.1.1 - which replaces everything - and then install mods one at a time until things break.

[Sir Osis of Liver]

We're using Core only for test purposes.  The original problem was session timeouts on login for some members.  Things have gone downhill since.  Custom theme works fine, but Curve bounces back to custom theme login.  Up until today, https://www.friendlychatting.co.uk/smf_2/ was being blocked by Kaspersky due to invalid certificate.  Allows me to view cert, it's configured for non-www.  Just now FF is giving me PR_CONNECT_RESET_ERROR, they must have changed something.  I would suggest fixing certificate first, then fix Curve.  Would not be comfortable upgrading this broken forum to 2.1 until it's working correctly.

Can try this in .htaccess -

Code Select Expand


# 301 REDIRECT HTTP TO HTTPS AND WWW TO NON-WWW
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,NE,R=301]
</IfModule>



[justuk]

Broken? My forum is NOT broken! thanks a lot. thats going to encourage people to join isn't it!    Close this topic.

[Aleksi "Lex" Kilpinen]

I am sorry, but when something doesn't work right, then it is broken. And since you opened this topic, and described an issue, you should already know there is something broken somewhere. The people in this topic are only trying to help you figure it out - If you don't want the help, then that is your choice to make, but please, if you do want to get things corrected then try not to take it personally when someone tells you there is something wrong. It is not an accusation towards you or your host, it is simply an observation about your current install and meant to help you.

[Steve]

Jane, you really should take on board the advice given you. And Lex's response explains everything in a nutshell.

But I will mark this topic solved as you wish so that others who might otherwise help know they can skip this.