Panel keeps logging me out

Kirby 2 Issues šŸ›
1

Iā€™ve updated to latest panel, kirby and toolkit version. (2.2.2)
But Panel seems to log me out at most unreasonable times, I save a page, try to edit again, and Iā€™m returned to the login page of the panel.
Or I try to navigate within the panel, when Iā€™m suddenly directed to the login page again.

2

Are you using csrf() anywhere on the front end?

Iā€™ve built custom forms and use the csrf() function for tokens, but if I have a panel edit page open, then view my custom form, the sessionā€™s token is replaced with my custom formā€™s token, therefore invalidating the panelā€™s edit form, which results in kicking me out of the panel.

3

Nope, not using csrf() anywhere

4

This is really weird. Could you please send me a message with some more details? I might need to have a closer look at your installation: bastian@getkirby.com

5

Hi @bastianallgeier and @tnViking ā€¦ Iā€™m getting this problem a lot.

Sometimes it stays logged for a minute, sometimes the login doesnā€™t even happensā€¦ pretty random thou.

I did some testing in several different connections, in the coworking place I use to hangout the local network have several internet providers and a load balance hardware to join them in one single access point. Itā€™s almost impossible to use the panel there.

At home on ADSL or using my mobile phoneā€™s 4g the panel stays logged normally.

Is there any check or something to turn off that makes it work?

6

BTWā€¦ Iā€™m using Dreamhostā€¦ any previous experience or issues in this regards with them?

7

Dev tools console spits out the following when Iā€™m logged in:

Refused to execute script from 'http://localhost/panel/plugins/js?v=2.2.3' 
because its MIME type ('text/html') is not executable, 
and strict MIME type checking is enabled.

:unamused:

[edit] Also sometimes the console shows:

Uncaught SyntaxError: Unexpected token <
8

Could you please send me an email. It would be perfect if I could run some tests on my own: bastian@getkirby.com

9

Email sent! :thumbsup:

10

Hm, Iā€™m having some very odd problems with this on a site as well! It didnā€™t happen at all when I was developing locally, but my client has been experiencing frequent log outs both on the staging site and on the live site (TSOhost). I havenā€™t done enough digging yet to see if Iā€™m experiencing the same errors as @rhawbert, Iā€™ll take a look at that next.

Any tips about what might be going on in the meantime?

11

After getting some help form @bastianallgeier whom instructed me to turn off some off the CSRF from the core altogetherā€¦ I ended up partially disabling it in the file: kirby/toolkit/lib/s.php.

I edited the line 113 from:

return sha1($_SERVER['HTTP_USER_AGENT'] . (ip2long($_SERVER['REMOTE_ADDR']) & ip2long('255.255.0.0')));

to:

return sha1($_SERVER['HTTP_USER_AGENT']);

If I disabled the whole thing, replacing lines 111 to 117 by this:


public static function fingerprint() { 
  return ''; 
}

Then Iā€™d get a kind of ā€œcross-loginā€, when two different users are logged from different locations/ipā€™s and one of the users get the wrong session and appear to logged as the other one.

Iā€™m using the former solution so far without problems (using dreamhost).

1 Like
12

I did a fix on that in the toolkt pull #146. Could you try that, and see if it works?
I havenā€™t had this issue for a while, so Iā€™m not sure how to check it.
Itā€™s been commited to the dev branch of toolkit, so I guess Itā€™ll be in a future release

13

You might want to check that $_SERVER['REMOTE_ADDR'] is set to the actual client IP in your hosting setup,

I got the same problem when hosting this in GCP k8s, because REMOTE_ADDR will be an ip to a proxy, and not the client ip, and it changes between requests. So I get logged out when that happens.

14

Iā€™m having the same issues and I canā€™t figure out whats going on.

For my current projects panel (latest Kirby):
On my localhost I never get logged out.
On the development server I never get logged out.

On the same development server the client, at some days, gets logged out constantly and at some days not.
(she tried various browsers and two different computers, reboots and everything)

It happens with or without the return sha1($_SERVER[ā€˜HTTP_USER_AGENTā€™]); change.

(On other projects, I basically never get logged out and my collegae does sometimes when we work together on the same site)

Very frustrating because I just canā€™t understand why :slight_smile:

Anyone have another idea?

Thanks,
Arno

15

Whatā€™s about the cookies in the browsers of the users?
Are they allowed?
Or deleted by an Add-On?

Kirby gives users normaly a session cookie!

16

Started to get this issue again, when I started using nginx and php-fpm on my mac.
Each time I edit a file, I am logged out of the panel. Any clues why?

17

When that happends to me, itā€™s always that I get a new IP. Really frustrating when trying to save all the work and just got logged out.

I think itā€™s a major problem and I hope to see persistent cookies to prevent this behavior every time the IP is changed.

18

I donā€™t get a new IP, Iā€™ve got a static IP from my ISP and static internal IP. So nothing here should change my IP.

19

I see it happens when I use browsersync.
I proxy domain.com on port 3000, and it reloads on each save file.
But I am logged in on domain.com/panel

But if Iā€™m logged in on domain.com:3000/panel, it does not log me out.
So it might be something that the browsersync proxy messes up the session/ cookies.

1 Like
20

I just published a change on the develop branch of the toolkit, which will make it possible to create your own session fingerprint.

<?php

s::$fingerprint = function() {
  return 'some fingerprint';
};

In scenarios, where IP or user agent based session fingerprints wonā€™t work, you can avoid problems that way.

5 Likes