2FA with Google Authenticator Not Working on Windows 10 PC - Works on iPhone

[Michael Vail]

Greeting everyone,

I'm unable to login to my account here on the Simple Machines site while using my desktop PC unless I disable 2FA on my account. When I try to login on my Windows 10 PC, I enter my username and password, and click Login as usual. Instead of being prompted for a 2FA code from my Authenticator app, it simply returns me to the homepage and my account isn't logged-in. There is no error message or anything. My iPhone works like it should. I've tried the Chrome, Firefox and Edge browsers and the results are the same.

If I disable 2FA on my account using my phone, I'm able to successfully login on my PC with just my username and password.

Any ideas?

Thank you,
Mike 

[Aleksi "Lex" Kilpinen]

I have similar experiences, if I first arrive to the front page at https://www.simplemachines.org/ directly and try to login as the first thing I do. I do not know why exactly, and it doesn't honestly seem to do it every time.
But what I've learned is that moving to the forum at https://www.simplemachines.org/community/index.php first and only logging in then will work, every time. ( At least for me. )

[Deaks]

does site team know they may be able to have a look??

[Aleksi "Lex" Kilpinen]

Well, this board is basically for that.

I have mentioned this before, and I think Sleepy did look in to it then too, but it does seem it isn't fully resolved yet.

[Michael Vail]

Thank you very much for the tip Aleksi. I'll give that a try and use that method. At least now I know why sometimes it worked but not others so I'm not chasing the problem around.

Happy Holidays!

[Arantor]

What URL are you on when you first begin the journey? I wonder if this is a CORS thing.

[Aleksi "Lex" Kilpinen]

After some playing around and testing, I think it could actually be as simple as the fact that our home page is available with and without the www subdomain.

If you simply type in simplemachines.org you end up at https://simplemachines.org, and if you then try to directly login it fails. Moving to https://www.simplemachines.org/ it works, just as it does after moving to the forum index, but I'm guessing the root cause of the change is the same.  They both use www.

So - If we simply redirected everyone to www this problem could just go away.
@SleePy

P.S. Disregard the odd resolution and proportions of the video, I grabbed the clip from a browser window only using 1/4 of the monitor. Scaling does some damage.

[SleePy]

I've adjusted some of the CORS settings.  I couldn't reproduce this myself, but if its CORS related it should fix it.

[Aleksi "Lex" Kilpinen]

Tried multiple times, used Edge (since I don't usually use that, and I have no odd extensions on it) and emptied the browser history before starting. It still seems to me that the top menu Login option invariably fails for me outside www.

Tested, Works:
https://www.simplemachines.org/
https://www.simplemachines.org/community/index.php
https://www.simplemachines.org/contribute/

Tested, Does not present 2FA prompt (Or sometimes seemingly randomly gives the "Wait 2 minutes" -error, right after clearing up browser history, but still fails).
https://simplemachines.org/
https://download.simplemachines.org/
https://custom.simplemachines.org/
https://support.simplemachines.org/
https://dev.simplemachines.org/

[SleePy]

Try it now.  I think I got it.  Cors is funny stuff.

[Aleksi "Lex" Kilpinen]

Quick test on a couple of the urls that didn't work earlier, looks good now! It's really late for me, but I'll check more thoroughly later. Thank you!

[SleePy]

Keep me updated, I have a PR for 2.1 and 3.0 then.

[Aleksi "Lex" Kilpinen]

Testing some different combinations I can come up with.

Test results, Location 1, PC 1, Network 1, Windows 11, Edge 120.0.2210.91 (Work Desktop)

1. Logged in from https://simplemachines.org - Works fine.
2. Logged in from https://custom.simplemachines.org/ - Works fine.
3. Logged in from https://support.simplemachines.org/ - Works fine.
4. Logged in from https://dev.simplemachines.org/ - Works fine.
5. Logged in from https://www.simplemachines.org/contribute/ - Works fine.
6. .Logged in from https://www.simplemachines.org/promo/ - Works fine.
7. Logged in from https://www.simplemachines.org/charter/ - Woks fine.
8. Logged in from https://www.simplemachines.org/about/smf/copyright.php - Works fine.
9. Logged in from https://www.simplemachines.org/community/index.php - Works fine.
10. Logged in from https://download.simplemachines.org/ - Works fine.
11. Logged in from https://blogs.simplemachines.org/ -Works fine.

Test results, Location 2, PC 2, Network 2, Windows 10, Edge 120.0.2210.91 (Home Desktop)

1. Logged in from https://simplemachines.org - Works fine.
2. Logged in from https://custom.simplemachines.org/ - Works fine.
3. Logged in from https://support.simplemachines.org/ - Works fine.
4. Logged in from https://dev.simplemachines.org/ - Works fine.
5. Logged in from https://www.simplemachines.org/contribute/ - Works fine.
6. .Logged in from https://www.simplemachines.org/promo/ - Works fine.
7. Logged in from https://www.simplemachines.org/charter/ - Works fine.
8. Logged in from https://www.simplemachines.org/about/smf/copyright.php - Works fine.
9. Logged in from https://www.simplemachines.org/community/index.php - Works fine.
10. Logged in from https://download.simplemachines.org/ - Works fine.
11. Logged in from https://blogs.simplemachines.org/ - Works fine.

Test results, Mobile 1, 5G Samsung SM-S918BZKHEUX, Android 14 / OneUI 6.0, Samsung Internet (Phone, Samsung S23 ultra. Not to brag )

1. Logged in from https://simplemachines.org - Works fine.
2. Logged in from https://download.simplemachines.org/ - Works fine.

That's 24 different succesful logins over the course of this day, using 3 different devices on 3 different networks, without ever repeating the disappearing login screen. So without knowing all the details of what you did behind the scenes, I'd say this at least seems to be fixed. Thank you!

Kind of offopic - Would like to ask, is there a valid good reason for the 2 minute delay, or could we perhaps cut that down to 1? Testing is sort of difficult with the 2 minute delay, and this isn't the first time I've run in to it.

[SleePy]

It is hard-coded into the logic, no way to change that.  Thanks, I will get a PR sent up.

[Aleksi "Lex" Kilpinen]

Oh well, can't win everytime. Just seems a bit excessive that delay, even though I kind of understand why it's there.

[Aleksi "Lex" Kilpinen]

Just following up on this, I haven't seen the issue since - I have seen the "wait" message once or twice when I didn't really expect to, but with the amount of logins I do that is probably just random hickups of some sort, possibly caused by the amount of devices I use. Which is ... Well, many. So seems like things are good

[Michael Vail]

Hi guys,

Just a quick follow-up to this issue I reported a while ago. I still have the same problem trying to login. Today I discovered something interesting that may help you figure out the issue. It's rather bizarre.

I often just use Google search to connect to websites I visit. When I Google search for SMF, I get the below pictured response from Google for the SMF website.

You cannot view this attachment.

I then click the circled text to visit the site and get the below page to login.

You cannot view this attachment.

Now, here's even more bizarreness. If I copy the link text for the circled link I use, it gives me: https://www.simplemachines.org/. If I paste that link directly into the address bar of into Chrome and go to the site, I can successfully login with authenticator every time! I DON'T GET IT!

It's when I do this that I consistently have the authentication problem and can't login. Then, after I use another link to login, I can't consistently reproduce it. It will just randomly occur if I haven't logged in for an undetermined period of time.

Anyway, maybe you guys can figure it out. Just thought you'd want to know. I can't be the only one dealing with this and I don't want it hurting your site when people come to use it.

Thanks for all you do,
Mike Vail

[Aleksi "Lex" Kilpinen]

Tried, with the exact same search terms even, and saw no issue. For me this issue has not come back.
Would anything change for you, if you emptied your browser cache and re-did the same test?