-
Notifications
You must be signed in to change notification settings - Fork 234
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Random User Logout and Cookie Anomalies #289
Comments
Thank you for bringing this up and for sharing all the details!
|
|
I tried adding some log statements to find the cause: Auth.php private function setRememberCookie($selector, $token, $expires) {
writeToLog("setRememberCookie() called. Selector: " . $selector . ", Token: " . $token . ", Expires: " . $expires);
$e = new \Exception();
writeToLog("Stack trace: " . $e->getTraceAsString());
$params = \session_get_cookie_params();
if (isset($selector) && isset($token)) {
$content = $selector . self::COOKIE_CONTENT_SEPARATOR . $token;
} else {
$content ='';
}
// save the cookie with the selector and token (requests a cookie to be written on the client)
writeToLog("Creating new Cookie object with name: " . $this->rememberCookieName);
$cookie = new Cookie($this->rememberCookieName);
$cookie->setValue($content);
$cookie->setExpiryTime($expires);
$cookie->setPath($params['path']);
$cookie->setDomain($params['domain']);
$cookie->setHttpOnly($params['httponly']);
$cookie->setSecureOnly($params['secure']);
$result = $cookie->save();
writeToLog("Cookie saved. Value: " . $cookie->getValue() . ", Expiry time: " . $cookie->getExpiryTime() . ", Path: " . $cookie->getPath() . ", Domain: " . $cookie->getDomain());
if ($result === false) {
throw new HeadersAlreadySentError();
}
// if we've been deleting the cookie above
if (!isset($selector) || !isset($token)) {
// attempt to delete a potential old cookie from versions v1.x.x to v6.x.x as well (requests a cookie to be written on the client)
writeToLog("Deleting old cookie with name: 'auth_remember'");
$cookie = new Cookie('auth_remember');
$cookie->setPath((!empty($params['path'])) ? $params['path'] : '/');
$cookie->setDomain($params['domain']);
$cookie->setHttpOnly($params['httponly']);
$cookie->setSecureOnly($params['secure']);
$cookie->delete();
writeToLog("Old cookie 'auth_remember' deleted");
}
} LOGS:
checkkdnr.php <?php
header('Content-Type: application/json');
header('Access-Control-Allow-Origin: https://abc.example.net'); //the website where the tampermonkey script should add data from my application
header("Access-Control-Allow-Headers: Content-Type");
header("Access-Control-Allow-Credentials: true");
use Delight\Auth\Auth;
require_once 'vendor/autoload.php';
require_once '/var/www/include/php_db.inc.php';
$error = '';
$db = php_db("users");
// Create a new instance of the Auth class
$auth = new \Delight\Auth\Auth($db);
if (!$auth->isLoggedIn()) {
// User is not logged in, redirect to the login page
header('Location: login.php');
exit;
} |
Thanks a lot! The behavior you showed happens only when an existing but invalid “remember me” cookie has been found, i.e. sent by the client and checked against the database on the server. So in your case there must have been a “remember me” cookie but it had invalid data. So then it is replaced with empty values (two empty strings separated by a Do you have any idea where that invalid cookie initially comes from? The file A possible solution would perhaps be replacing $this->setRememberCookie('', '', \time() + 60 * 60 * 24 * 365.25); with $this->setRememberCookie(null, null, \time() - 3600); and seeing if that changes anything. But that would only remove the invalid cookie instead of replacing it with a |
Hello,
I'm currently experiencing a random logout issue while using the PHP-Auth library in my application, predominantly on Windows machines. macOS users do not seem to experience this problem. The symptoms also include anomalies with the user session cookies:
Anomalies:
Users are randomly logged out, without any discernible pattern or trigger.
A specific session cookie seems to behave oddly:
Name: remember_6TpGxxxxxxx
Value: %7E (Notably shorter than typical values I observe when logged in.)
Expires: 2024-07-16T20:43:45.520Z (This is definitely incorrect as the expiry date gets updated to a correct value when the user logs in again.)
These issues occur when running a Tampermonkey script with Chrome on an external domain (example1.com) to interact with the login-protected domain (example2.com).
Despite preliminary debugging efforts using browser developer tools and server-side logging, the root cause of this issue remains elusive...
If anyone could provide some guidance or hints on where to start further debugging, I would greatly appreciate it. Thank you in advance for your assistance.
The text was updated successfully, but these errors were encountered: