NEW USERS - HOW TO REGISTER!

[SunsRIt]

It’s like the keep me logged in button isn’t working.

[Superbone]

It’s like the keep me logged in button isn’t working.

Yep. Something has changed in the forum code. (Well, could be a Safari change too, I suppose.) It was working fine until recently. A funny thing happening now is I can refresh the page and it will show me logged in and your new post and when I click on the flag to go to latest, I'm sitting on the first post now and logged out. Definitely Safari specific as Firefox hasn't logged me out once since keeping a parallel page open on it.

[SunsRIt]

It’s like the keep me logged in button isn’t working.

Yep. Something has changed in the forum code. (Well, could be a Safari change too, I suppose.) It was working fine until recently. A funny thing happening now is I can refresh the page and it will show me logged in and your new post and when I click on the flag to go to latest, I'm sitting on the first post now and logged out. Definitely Safari specific as Firefox hasn't logged me out once since keeping a parallel page open on it.

I just moved around between threads without going to the flag to go to the last post and it worked fine. If I do use the flag it logs out and I have to sign in again. I also have to log back in when I go back to the site after using other apps on my phone.

[Mori Chu]

Okay, I have made some changes to the server settings that I think may help, based on some info I read today.

For the nerds in here, some details: I think it has to do with top-level vs subdomain cookies. When you log in to this site or many others, the site leaves a cookie in your browser with some info about your login. Our site is on the domain www.phx-suns.net, but the cookie was being set on the top-level domain name of just phx-suns.net. In theory that would be just fine; a cookie on the top-level domain is meant to cover all subdomains under it. But recent best practices in web security recommend not using this feature because it can allow a malicious cookie set in one place to possibly affect another place, particularly sites that have a bunch of subdomains, such as sites where each user gets a subdomain called e.g. myusername.example.com.

Anyway, from my reading, recent versions of Safari have started to block cookies unless the cookie has EXACTLY the same domain name as the site. So a cookie set on just phx-suns.net would not be allowed or found when going to www.phx-suns.net. That's why the site would think you were logged out. There may have been another issue related to cookies and http vs https protocol, but I am not positive.

I made a change so that the cookies will be set on www.phx-suns.net securely, and I hope this will help. I think Safari is the only browser to strictly enforce this kind of cookie-blocking behavior by default, but others will likely follow. So it's good to try to get it fixed now before other folks start seeing issues.

TL;DR - I think I may have fixed the issue by tweaking the board settings. For those who were having problems in Safari: after logging in this afternoon (later than 3:05pm AZ time), do you still see the issue? Let me know. Thx.

[Superbone]

Awesome! That makes sense to me and why it was logging us out in the middle of a session when changing threads.

[SunsRIt]

I appreciate your efforts. I just used the flag to go to the last read and it logged me right out.

[Superbone]

I appreciate your efforts. I just used the flag to go to the last read and it logged me right out.

Have you tried clearing your cache for the site? So far, so good for me. Just used the flag and it worked like it's supposed to.

ETA: And as soon as I say that, I go to a new post on another thread and it logged me out and took me to the first post.

[pickle]

Yep I also just got logged out again too.

[Mori Chu]

Are we sure it has anything to do with the flag? You're talking about the blue "new messages in this thread" icon right? My theory is that even if you didn't click the flag, just clicking around on the site would lead you to get logged out because your cookies aren't being stored. I will dig into it more today.

[Superbone]

Are we sure it has anything to do with the flag? You're talking about the blue "new messages in this thread" icon right? My theory is that even if you didn't click the flag, just clicking around on the site would lead you to get logged out because your cookies aren't being stored. I will dig into it more today.

For me it's orange but yeah. I just got on today. I was logged out to start. Logged in (with the keep me logged in flag). Saw somebody hearted one of my posts. Went to said post. Read the rest of that thread and saw there were no more new posts since yesterday. Came back out. Clicked on the orange flag for this thread and it logged me out and took me to the first post in the thread.

[Split T]

I don’t ever use the flag and it logs me out all the time still.

[Superbone]

I don’t ever use the flag and it logs me out all the time still.

BTW, it's only a flag in these top two sticky threads. It's a caption box in the other threads. It takes you to the next unread message.

[Split T]

Ya I got confused…I do use it lol..but I still get logged out even when I don’t use it.

[Superbone]

It is weird that the flag on this particular thread when there are new posts seems to most often log me off.

[pickle]

I’m getting kicked out fairly frequently again. Was ok for a couple of days in between. No real pattern to it either.

[Mori Chu]

I'm still looking into this and haven't found the fix. FWIW I had not changed any board settings or done any upgrades at all at the time that this issue started happening. I think it was a change to Safari, an auto-update that tightened the default security settings, that has led to the issue. I'll keep digging.

[Mori Chu]

It looks like in order to fix this ongoing issue, I will need to update the phpbb software that the board runs on. It would take the site down for a while, so I will probably wait to do it until late tonight to minimize disruption. FYI.