NEW USERS - HOW TO REGISTER!

[SunsRIt]

I’m getting kicked out very frequently today. Maybe it’s time to try chrome.

That’s exactly what I did today. Couldn’t stay logged in at all on Safari the last couple of days.

[Split T]

Ya I’ve switched to chrome

[Superbone]

Murphy's Law is hilarious. I just came to post in this thread that Safari seemed to be stable the last couple days and when I clicked on Split's last post so I could reply, it logged me out and I had to re-log in to reply. I seriously think there is something specific to this particular thread that logs one out. I'm going to stay away from this thread and see what happens. If there is a new post in this thread, I'll check it in Firefox where the site has been rock solid.

[Superbone]

Definitely not just this thread. Lots of issue in other thread. But I did just login AGAIN for the 5th time today at least, and clicked on the link to the end of the thread and was logged off AGAIN!

[Mori Chu]

OK, after being stuck for a while, I think I have made some more progress on this issue. Claude AI suggests what he thinks is the cause: Safari has recently added features called "iCloud Private Relay" and "Hide IP Address" that both use VPN technology to cause your computer to rotate across multiple different IP addresses during your sessions. This confuses our site because our site's login cookies tag the specific IP address that was used for the login and then don't allow you to use that same cookie from any other IP address; this is to prevent various attacks where bad guys get ahold of your cookie and use it to access the site with your credentials. But in this case, the security feature breaks with the aforementioned Safari settings.

So, for a start, I just disabled the IP address checking stuff in our site settings. That would, in theory, help avoid this issue. (Might need to log out/in to see the effect.) Secondly, for users on Safari, you could try to disable the IP hiding stuff to see if it helps. Claude says:

Ask one affected Safari user to test with iCloud Private Relay turned off (Settings → [Apple ID] → iCloud → Private Relay, or Safari → Settings → Privacy on Mac) and see if the logging-out stops. This single test will confirm or rule out the theory cleanly.

So let's try that for a moment and see if we see any improvement. If not, Claude and I will go back to the drawing board.

[Superbone]

OK, after being stuck for a while, I think I have made some more progress on this issue. Claude AI suggests what he thinks is the cause: Safari has recently added features called "iCloud Private Relay" and "Hide IP Address" that both use VPN technology to cause your computer to rotate across multiple different IP addresses during your sessions. This confuses our site because our site's login cookies tag the specific IP address that was used for the login and then don't allow you to use that same cookie from any other IP address; this is to prevent various attacks where bad guys get ahold of your cookie and use it to access the site with your credentials. But in this case, the security feature breaks with the aforementioned Safari settings.

So, for a start, I just disabled the IP address checking stuff in our site settings. That would, in theory, help avoid this issue. (Might need to log out/in to see the effect.) Secondly, for users on Safari, you could try to disable the IP hiding stuff to see if it helps. Claude says:

Ask one affected Safari user to test with iCloud Private Relay turned off (Settings → [Apple ID] → iCloud → Private Relay, or Safari → Settings → Privacy on Mac) and see if the logging-out stops. This single test will confirm or rule out the theory cleanly.

So let's try that for a moment and see if we see any improvement. If not, Claude and I will go back to the drawing board.

I continue to get logged off many times a day. I just paused my private relay for the day. Unfortunately, I don't think you can only do it for a single site and it doesn't seem like a good idea to keep it off in general. I'll report back if it fixes the issue.

[Superbone]

Unfortunately, it still happens even with Private Relay off.

[Mori Chu]

I will go back to the drawing board later today and see if there's anything else I can try.

[Superbone]

I will go back to the drawing board later today and see if there's anything else I can try.

Tell Claude to up his game!

[Mori Chu]

Claude offers these suggestions:

Check Safari's "Advanced Tracking and Fingerprinting Protection" separately from Private Relay
This is a different setting from Private Relay (introduced Safari 17+, on by default in Private Browsing, and increasingly enabled in regular windows too on recent iOS/macOS). It injects noise/normalizes some browser signals per-visit. If phpBB's session-hijack check ever touches anything derived from these fingerprint signals (less common, but worth ruling out), this could cause intermittent invalidation independent of IP. Have an affected user check per-site settings (tap the "AA"/page-settings icon in Safari's address bar → Settings for This Website) and try turning it off for your domain specifically.

Anyone on Mac/Safari willing to try disabling that setting?

Confirm there's no www vs. non-www (or http vs https) inconsistency
If your cookie domain is blank (host-only cookie, tied exactly to www.phx-suns.net), but any path on your site — a link in a notification email, a bookmark, an old inbound link — points to bare phx-suns.net instead of www.phx-suns.net, the cookie simply won't apply there, host-only cookies don't match a different host. Confirm your server issues a hard 301 redirect from the apex domain (and from plain http://) to https://www.phx-suns.net in all cases, not just some. This would explain "click a link, land on an unauthenticated page" independent of any Safari privacy feature, though it should in theory hit all browsers — worth ruling out regardless since it's a 5-minute check.

^ It seems like you guys see this logout problem specifically when you click on that "new posts" icon. If you hover over that icon but don't click it, it should show you the link's URL. Does the URL point to phx-suns.net or www.phx-suns.net? It should be the latter; if it is the former (without www), that could be the issue. When I hover on such links in Chrome, the link points to www.phx-suns.net, but I wanted to confirm from a Safari user.

Test whether "Remember me" at login changes the behavior
If checking "Remember me" (which sets a longer-lived persistent autologin cookie in addition to the session cookie) makes the problem go away or become much rarer, that isolates the fault to the plain session cookie specifically (e.g., a short server-side session_length, or WebKit's handling of non-persistent cookies under tab/process lifecycle management), rather than to IP/fingerprinting logic.

^ Did you guys say that the problem was worse when you DO check the "Remember me" box? You said that, right? If you don't check that box, is the problem less noticeable?

[Superbone]

Claude offers these suggestions:

Check Safari's "Advanced Tracking and Fingerprinting Protection" separately from Private Relay
This is a different setting from Private Relay (introduced Safari 17+, on by default in Private Browsing, and increasingly enabled in regular windows too on recent iOS/macOS). It injects noise/normalizes some browser signals per-visit. If phpBB's session-hijack check ever touches anything derived from these fingerprint signals (less common, but worth ruling out), this could cause intermittent invalidation independent of IP. Have an affected user check per-site settings (tap the "AA"/page-settings icon in Safari's address bar → Settings for This Website) and try turning it off for your domain specifically.

Anyone on Mac/Safari willing to try disabling that setting?

Confirm there's no www vs. non-www (or http vs https) inconsistency
If your cookie domain is blank (host-only cookie, tied exactly to www.phx-suns.net), but any path on your site — a link in a notification email, a bookmark, an old inbound link — points to bare phx-suns.net instead of www.phx-suns.net, the cookie simply won't apply there, host-only cookies don't match a different host. Confirm your server issues a hard 301 redirect from the apex domain (and from plain http://) to https://www.phx-suns.net in all cases, not just some. This would explain "click a link, land on an unauthenticated page" independent of any Safari privacy feature, though it should in theory hit all browsers — worth ruling out regardless since it's a 5-minute check.

^ It seems like you guys see this logout problem specifically when you click on that "new posts" icon. If you hover over that icon but don't click it, it should show you the link's URL. Does the URL point to phx-suns.net or www.phx-suns.net? It should be the latter; if it is the former (without www), that could be the issue. When I hover on such links in Chrome, the link points to www.phx-suns.net, but I wanted to confirm from a Safari user.

Test whether "Remember me" at login changes the behavior
If checking "Remember me" (which sets a longer-lived persistent autologin cookie in addition to the session cookie) makes the problem go away or become much rarer, that isolates the fault to the plain session cookie specifically (e.g., a short server-side session_length, or WebKit's handling of non-persistent cookies under tab/process lifecycle management), rather than to IP/fingerprinting logic.

^ Did you guys say that the problem was worse when you DO check the "Remember me" box? You said that, right? If you don't check that box, is the problem less noticeable?

Strangely, I haven't been logged out so far today.

1. I only have Advanced tracking and fingerprint protection on for "Private Browsing".
2. I only see "Unread" when hovering over the icon.
2. I always check "Remember me". If I get logged out again, I will NOT check it and see if there is any difference.

[Mori Chu]

Claude also asks me to ask users who are affected by this bug:

Ask one or two of the affected users two follow-up questions next time it happens:

Does a plain reload/refresh of that "new posts" page fix it? If yes — the page they were looking at was stale (old sid baked in), and reloading gets a fresh one. That confirms the stale-page/sid-mismatch theory, not a real logout.
After hitting the unauthenticated page, do they check another page — like the forum index? If they're still shown as logged in there, they were never actually logged out server-side; only that one specific stale link failed. If they're logged out everywhere after that click, it's a real session/cookie loss and we're back to investigating the cookie mechanics.

^ In other words, you log in with Safari, you click the "New posts" icon. It takes you to the thread, but now the page says you are logged out. OK, now try this. From that point, if you just click the address bar and type https://www.phx-suns.net/ and press Enter, it takes you back to the front page. On that front page, does it still think you are logged out? Or has it suddenly remembered who you are and re-logged you back in? In other words, the logout effect, is it transitory just to that one page for the New Posts, or is it a sticky effect where you are now logged out no matter where you travel on the site? Thanks.

Claude thinks maybe PHPBB is inserting incorrect session ID information in link URLs which is causing the session/login info to get messed up. Q: If you hover on the "New posts" icon without clicking it, does its target URL have &sid=xxxxxx in it? (Not literally xxxxxx, but some kind of alphanumeric string after sid=)

the failure is likely happening one level up from cookies entirely: phpBB embeds the session ID (sid) as a URL parameter in its own links (e.g. the "new posts" icon points to something like search.php?search_id=newposts&sid=xxxxx), as a secondary belt-and-suspenders check alongside the cookie. If the page containing that link was rendered before login (i.e., it has the old/anonymous sid baked into its HTML), clicking it sends a sid that no longer matches the freshly-created logged-in session — and phpBB can reject that specific request even though the login cookie itself is perfectly valid.

[Superbone]

Claude also asks me to ask users who are affected by this bug:

Ask one or two of the affected users two follow-up questions next time it happens:

Does a plain reload/refresh of that "new posts" page fix it? If yes — the page they were looking at was stale (old sid baked in), and reloading gets a fresh one. That confirms the stale-page/sid-mismatch theory, not a real logout.
After hitting the unauthenticated page, do they check another page — like the forum index? If they're still shown as logged in there, they were never actually logged out server-side; only that one specific stale link failed. If they're logged out everywhere after that click, it's a real session/cookie loss and we're back to investigating the cookie mechanics.

^ In other words, you log in with Safari, you click the "New posts" icon. It takes you to the thread, but now the page says you are logged out. OK, now try this. From that point, if you just click the address bar and type https://www.phx-suns.net/ and press Enter, it takes you back to the front page. On that front page, does it still think you are logged out? Or has it suddenly remembered who you are and re-logged you back in? In other words, the logout effect, is it transitory just to that one page for the New Posts, or is it a sticky effect where you are now logged out no matter where you travel on the site? Thanks.

Just got logged out and tried this. Still logged out. I just logged in again this time without "remember me".

[Mori Chu]

I just made a cookie change that would cause everybody to log out if they had an active session. So you may see yet another logout just now. Claude thinks that some users may have stale cookies lying around, so I changed the name of our cookies to try to flush that out.

If you guys find any way that pretty consistently reproduces the issue, I can try using Safari to get it to happen on my end. I am posting this message from Safari now (with all the various privacy / IP hiding features enabled) and I can't get it to log me out. So if there's a specific button or link or set of clicks you use that most often result in the issue occurring, do let me know.

Folks have mentioned that the issue occurs when checking for new posts. Do you mean clicking on each thread's "New Posts" icon? Is there another New Posts link that my old eyes are missing?

[Superbone]

I just made a cookie change that would cause everybody to log out if they had an active session. So you may see yet another logout just now. Claude thinks that some users may have stale cookies lying around, so I changed the name of our cookies to try to flush that out.

If you guys find any way that pretty consistently reproduces the issue, I can try using Safari to get it to happen on my end. I am posting this message from Safari now (with all the various privacy / IP hiding features enabled) and I can't get it to log me out. So if there's a specific button or link or set of clicks you use that most often result in the issue occurring, do let me know.

Folks have mentioned that the issue occurs when checking for new posts. Do you mean clicking on each thread's "New Posts" icon? Is there another New Posts link that my old eyes are missing?

Yeah, often the New Posts link or for a thread with no new posts that I want to add to, the last poster link (Go To Last Post, to the right of the thread).

[Superbone]

So far, so good with the great cookie bake off flush out.

[Superbone]

It seems better but I'm still occasionally getting logged out. I assume ASFN has more up to date forum software? I haven't had any issues there.

[Mori Chu]

Circling back on this. Is anybody still getting logged out regularly from the board on Safari? Has it gotten any better lately, or still just as bad?

[Superbone]

Circling back on this. Is anybody still getting logged out regularly from the board on Safari? Has it gotten any better lately, or still just as bad?

Sorry to say I just gave up and it's been horrible. I just relogin many times a day. I refuse to change my browser for one site. Having said that, it hasn't happened to me today yet.

[BKinSJC]

I switched to a Chromium-based browser on my laptop. On my phone, I've been mostly avoiding going on the site, but relogging when I do.