Iāve updated to latest panel, kirby and toolkit version. (2.2.2)
But Panel seems to log me out at most unreasonable times, I save a page, try to edit again, and Iām returned to the login page of the panel.
Or I try to navigate within the panel, when Iām suddenly directed to the login page again.
Are you using csrf() anywhere on the front end?
Iāve built custom forms and use the csrf() function for tokens, but if I have a panel edit page open, then view my custom form, the sessionās token is replaced with my custom formās token, therefore invalidating the panelās edit form, which results in kicking me out of the panel.
Nope, not using csrf() anywhere
This is really weird. Could you please send me a message with some more details? I might need to have a closer look at your installation: bastian@getkirby.com
Hi @bastianallgeier and @tnViking ā¦ Iām getting this problem a lot.
Sometimes it stays logged for a minute, sometimes the login doesnāt even happensā¦ pretty random thou.
I did some testing in several different connections, in the coworking place I use to hangout the local network have several internet providers and a load balance hardware to join them in one single access point. Itās almost impossible to use the panel there.
At home on ADSL or using my mobile phoneās 4g the panel stays logged normally.
Is there any check or something to turn off that makes it work?
BTWā¦ Iām using Dreamhostā¦ any previous experience or issues in this regards with them?
Dev tools console spits out the following when Iām logged in:
Refused to execute script from 'http://localhost/panel/plugins/js?v=2.2.3'
because its MIME type ('text/html') is not executable,
and strict MIME type checking is enabled.
[edit] Also sometimes the console shows:
Uncaught SyntaxError: Unexpected token <
Could you please send me an email. It would be perfect if I could run some tests on my own: bastian@getkirby.com
Email sent! 
Hm, Iām having some very odd problems with this on a site as well! It didnāt happen at all when I was developing locally, but my client has been experiencing frequent log outs both on the staging site and on the live site (TSOhost). I havenāt done enough digging yet to see if Iām experiencing the same errors as @rhawbert, Iāll take a look at that next.
Any tips about what might be going on in the meantime?
After getting some help form @bastianallgeier whom instructed me to turn off some off the CSRF from the core altogetherā¦ I ended up partially disabling it in the file: kirby/toolkit/lib/s.php.
I edited the line 113 from:
return sha1($_SERVER['HTTP_USER_AGENT'] . (ip2long($_SERVER['REMOTE_ADDR']) & ip2long('255.255.0.0')));
to:
return sha1($_SERVER['HTTP_USER_AGENT']);
If I disabled the whole thing, replacing lines 111 to 117 by this:
public static function fingerprint() {
return '';
}
Then Iād get a kind of ācross-loginā, when two different users are logged from different locations/ipās and one of the users get the wrong session and appear to logged as the other one.
Iām using the former solution so far without problems (using dreamhost).
1 Like
I did a fix on that in the toolkt pull #146. Could you try that, and see if it works?
I havenāt had this issue for a while, so Iām not sure how to check it.
Itās been commited to the dev branch of toolkit, so I guess Itāll be in a future release
You might want to check that $_SERVER['REMOTE_ADDR'] is set to the actual client IP in your hosting setup,
I got the same problem when hosting this in GCP k8s, because REMOTE_ADDR will be an ip to a proxy, and not the client ip, and it changes between requests. So I get logged out when that happens.
Iām having the same issues and I canāt figure out whats going on.
For my current projects panel (latest Kirby):
On my localhost I never get logged out.
On the development server I never get logged out.
On the same development server the client, at some days, gets logged out constantly and at some days not.
(she tried various browsers and two different computers, reboots and everything)
It happens with or without the return sha1($_SERVER[āHTTP_USER_AGENTā]); change.
(On other projects, I basically never get logged out and my collegae does sometimes when we work together on the same site)
Very frustrating because I just canāt understand why 
Anyone have another idea?
Thanks,
Arno
Whatās about the cookies in the browsers of the users?
Are they allowed?
Or deleted by an Add-On?
Kirby gives users normaly a session cookie!
Started to get this issue again, when I started using nginx and php-fpm on my mac.
Each time I edit a file, I am logged out of the panel. Any clues why?
When that happends to me, itās always that I get a new IP. Really frustrating when trying to save all the work and just got logged out.
I think itās a major problem and I hope to see persistent cookies to prevent this behavior every time the IP is changed.
I donāt get a new IP, Iāve got a static IP from my ISP and static internal IP. So nothing here should change my IP.
I see it happens when I use browsersync.
I proxy domain.com on port 3000, and it reloads on each save file.
But I am logged in on domain.com/panel
But if Iām logged in on domain.com:3000/panel, it does not log me out.
So it might be something that the browsersync proxy messes up the session/ cookies.
1 Like
I just published a change on the develop branch of the toolkit, which will make it possible to create your own session fingerprint.
<?php
s::$fingerprint = function() {
return 'some fingerprint';
};
In scenarios, where IP or user agent based session fingerprints wonāt work, you can avoid problems that way.
5 Likes