Auto-Log-Out Time

[Qweesdy]

Hi,

Every time I come to these forums (which can be daily) the forum software has forgotten me and I have to log back in. It doesn't happen on any other forum I've ever used on the Internet (they all use cookies with a time-out of at least 1 day, so that you don't need to log in every single time; sometimes with a "remember me" checkbox in case you're not using your own/regular computer). It's annoying, and it's one of the reasons I don't post - easier to lurk without logging in and not post.

Today, the forums logged me out while I was typing a new post. I was logged in; I finished proof-reading and editing, then I hit "preview" and the whiny piece of crap complained that I need to be logged in to do that(!).

Is this broken by accident, or is it broken by design?

 

[Crusade]

Something, something cookies and registry authentication.
DukeofRealms care to give some actual insight on this?

 

[CyberTao]

last time I recall Duke being asked he responded "Well it works for me".

 

[DukeofRealms]

Is this broken by accident, or is it broken by design?

"Well it works for me"

Sometimes logouts are server side, like when we were having issues in December. Server side issues are logged, I don't see any errors relating to logouts in the past month.

When we were having legitimate server-side auto logouts I was getting reports every day (I was also experiencing it myself). This is not the case, which indicates to me that the issues you are experiencing are clientside.

 

[Crusade]

DukeofRealms Might it be a cookie issue with the Registry itself? Or between the registry and SMD?

 

[Deleted Account]

Same here. I always have to click the log in button whenever I visit the dock.

 

[DukeofRealms]

Same here. I always have to click the log in button whenever I visit the dock.

Logging out from closing the browser is intended. If you're getting logged out while browsing the site, this is not intended.

 

[Deleted Account]

Logging out from closing the browser is intended. If you're getting logged out while browsing the site, this is not intended.

Oh, fair enough then.

 

[Sachys]

Logging out from closing the browser is intended.

Why is it that way? - Seems rather odd for such a site (to me at least).

 

[Qweesdy]

Hi,

Logging out from closing the browser is intended.

That seems broken to me too; but it's a lesser issue.

If you're getting logged out while browsing the site, this is not intended.

It's like there's a cookie with a "far too small" time-out (e.g. 10 minutes rather than 10 days); and when you're regularly clicking links the cookie and its time-out is updated, which keeps you logged in; and when you're not clicking links (e.g. you're spending 30 minutes writing/editing a post) nothing updates the cookie's time-out and as soon as you click "preview" or "post" it whines that you need to be logged in to do that, then when you do log back in it sends you back to the forum's main page causing you to lose everything you've just spent writing/editing.

 

[DukeofRealms]

It's like there's a cookie with a "far too small" time-out (e.g. 10 minutes rather than 10 days); and when you're regularly clicking links the cookie and its time-out is updated, which keeps you logged in; and when you're not clicking links (e.g. you're spending 30 minutes writing/editing a post) nothing updates the cookie's time-out and as soon as you click "preview" or "post" it whines that you need to be logged in to do that, then when you do log back in it sends you back to the forum's main page causing you to lose everything you've just spent writing/editing.

I'm on here every day, a tab is opened on this site throughout most of the day, it's never logged out. I've tested this site on multiple computers, different locations, never experienced this issue. I see maybe two or three reports every year, which leads me to believe it's client side.

I am aware that the TOR browser experiences this issue. What's your OS and browser? Are you using a VPN?

 

[Qweesdy]

Hi,

I'm on here every day, a tab is opened on this site throughout most of the day, it's never logged out. I've tested this site on multiple computers, different locations, never experienced this issue. I see maybe two or three reports every year, which leads me to believe it's client side.

It's possible that out of the entire player base; maybe 50% don't use the forums, 30% never spend longer than 10 minutes writing a post, 19.9% ignore the problem (like I did until now), 0.05% have reported it in the past and don't want to report it again, and that remaining 0.05% adds up to 2 or 3 reports every year.

I am aware that the TOR browser experiences this issue. What's your OS and browser? Are you using a VPN?

It's Gentoo Linux and Chromium, without any TOR or VPN.

Using "developer tools" in Chromium it shows 4 cookies for the "starmade.net" domain. One expires in 2018 and one expires in 2019 (and I assume one or both are responsible for allowing me to log in just by clicking the "log in" button without providing username and password). One expires when the session ends (which apparently, for some browsers, may have nothing to do with when the browser is closed) and deleting it and clicking a link logs me out (as expected). The final cookie (named "__gat") expires 10 minutes after I click on any link; and I assume there some unwanted interaction between this cookie and the session cookie that is causing the problem (and I'm not able to think of a plausible reason for this cookie to exist at all).

 

[DukeofRealms]

It's possible that out of the entire player base; maybe 50% don't use the forums, 30% never spend longer than 10 minutes writing a post, 19.9% ignore the problem (like I did until now), 0.05% have reported it in the past and don't want to report it again, and that remaining 0.05% adds up to 2 or 3 reports every year.

Sure, but that would be at least over 20 reports per year, which simply isn't the case

Using "developer tools" in Chromium it shows 4 cookies for the "starmade.net" domain. One expires in 2018 and one expires in 2019 (and I assume one or both are responsible for allowing me to log in just by clicking the "log in" button without providing username and password). One expires when the session ends (which apparently, for some browsers, may have nothing to do with when the browser is closed) and deleting it and clicking a link logs me out (as expected).

I assume you mean starmadedock.net. xf_session is the cookie responsible for session time.

The final cookie (named "__gat") expires 10 minutes after I click on any link; and I assume there some unwanted interaction between this cookie and the session cookie that is causing the problem (and I'm not able to think of a plausible reason for this cookie to exist at all).

This cookie, I assume is your online status indicator, once it expires, the forum no longer displays you as online. Just a guess, but that's what it looks like to me.

I've looked around and it appears other forums (of the same software) have received reports that a small number of users are logged out very quickly mid posting. I've attempted to modify online status indicator cookie to a longer period (as it appears to match the time specified), it doesn't appear to work for me. One "solution" I can think of, is to force "remember me" setting internally on all logins, quite the overkill.

 

[Qweesdy]

Hi,

I assume you mean starmadedock.net. xf_session is the cookie responsible for session time.

Yes.

This cookie, I assume is your online status indicator, once it expires, the forum no longer displays you as online. Just a guess, but that's what it looks like to me.

I've looked around and it appears other forums (of the same software) have received reports that a small number of users are logged out very quickly mid posting. I've attempted to modify online status indicator cookie to a longer period (as it appears to match the time specified), it doesn't appear to work for me. One "solution" I can think of, is to force "remember me" setting internally on all logins, quite the overkill.

For more information; I did a little test - I left the browser running for hours (since my previous post above): It didn't log me out at all. It only happens when I'm editing a post.

It's like that "__gat" cookie (with the 10 minute expiry) is checked when you click the "post reply" or "preview" buttons after editing, but isn't checked for browsing.

 

[arouq]

I get this issue as well, I do use a VPN. Yes, I am a security nutter .

One "solution" I can think of, is to force "remember me" setting internally on all logins, quite the overkill.

I would very much like this. I can't use this forum as it currently stands, although, I despise sites that don't have auto logout times, I'd be willing to sacrifice that to be able to actually post. Otherwise, I lurk. I got logged out four times in the last 6 minutes....