Suddenly no more access to the panel

The CMS Questions
1

I just had a very disturbing behavior of the panel: out of the blue i could not log in anymore. With none of my users. But on another domain/server with an older state of the website it worked without problems. It worked for weeks on the new domain without any problems.

I also use the API to grab data. I’m not sure if it was a coincidence, but: After removing all accounts on the FTP and activating panel.install to create a fresh user, I got back into the panel. However, shortly after I made an API query with basicAuth, I wasn’t able to get into the panel again, even with the new user.

And then, 10 minutes later, without doing anything again, I got back in. Which is good but also bad, because I am afraid this will happen again.

When I was not able to login to the panel I also wasn’t able to connect with basicAuth to the API.

Yesterday, for the first time, I had created an editor role for one of the users. But after that everything still worked, even this morning.

What could be the reason for the spontaneous not being able to log in?

2

And it happend again. :-/

And I think it is connected with API request:

Everything was working, also the request. But as soon a did another second request in my API I got “blocked” and from then on was not able to request something with the user credentials and I was not able to login anymore in the panel.

The browser console gives me this:

1. {status: 'error', message: 'Ungültige Zugangsdaten', code: 403, exception: 'Kirby\\Exception\\PermissionException', key: 'error.access.login', …}


  1. code: 403
  2. details: []
  3. exception: "Kirby\\Exception\\PermissionException"
  4. file: "/kirby/src/Cms/Auth.php"
  5. key: "error.access.login"
  6. line: 564
  7. message: "Ungültige Zugangsdaten"
  8. route: "auth/login"
  9. status: "error"
  10. [[Prototype]]: Object
3

Only when I am deleting all user and do panel.install again with a new user it is working again.

But: I really need to get rid of this behaviour. Does anyone has an idea, how this could happen and how to fix this?

Also strange that, that none user could login after the error occurs, not only the user i am using for the API request.

4

Which Kirby version are you using?

Does Kirby create .logins file in the account folder when this happens? With what content?

5

Yes, Kirby created a .logins-file:

{"by-ip":{"d7fcce1a9b7f7a692d740e6a7e7f3f8483855bd2ec5c2fbd78":{"time":1678879259,"trials":10}},"by-email":[]}

Kirby Version: 3.9.1
PHP 8.0.28
KQL Version: 2.0.0

6

Hm, this has 10 trials by IP. That explains why access gets blocked. Are you making invalid login requests?

7

Not sure, but could be… I am working with VVVV, a C# environment running and compiling code in realtime. Maybe a error occurs which lets my app hold on a certain state, where the request is done multiple times per second. Which then causes the bug. Will investigate the next time, when it happens.

Question is for me then: Is there any other fix then deleting and creating all users again?

8

You can delete the .logins file. If this is a development environment, you could also increase the number of allowed auth trials in your config:

9

Thanks a lot. So this is not a bug, but a feature. :muscle: