Site is working fine, cookie domain is correct, https is on, secure cookies on, http to https redirect in .htaccess is on.
If a user logs into the site, ticks the remember me option, they will remain logged in and can post fine.
However, if user leaves tab open with a period of inactivity, say an hour, when they return they are logged out.
I have Allow "Remember Me" logins: Yes
"Remember Me" login key expiration length (in days): 30
Am I missing another setting somewhere that would keep the user logged in? I don't think I understand the purpose of the two options above as they dont appear to remember logins.
Losses of sessions are generally caused by a problem with the cookies (cookies transmitted for a bad domain, server not on time (which means that the expiration date of cookies is incorrect), etc.).
Read this for your cookie: https://www.phpbb.com/support/docs/en/3 ... -settings/
Sorry for my English ... I do my best!
phpBB: 3.3.11 | PHP: 8.2.16
[Kill spam on phpBB] - [Some Frenchtranslationof extensions] "Mistress, Mistress someone is bothering me in pm"
ukautoforums wrote: ↑Wed Jan 05, 2022 3:05 pm
I will change this and see if it makes a difference.
This won't fix issue, increasing may allow them to stay logged in longer but it won't keep them logged in. Do a quick check for URL's on your forum. If the URL's all have the parameter ?sid=longstringofalphanumeric then cookies are not being set correctly. The sid in the URL can appear first page load but should not persist.
A link to your forum would help. you can also fill out the SRT.
t he remember me setting is so that if your session time expires you will automatically be logged in when you create activity on the site like clicking
on something.
your session time setting is where you set that, it is not meant to keep people logged in forever.
give it some resonable time and then let the automatic login cover the rest. people will not know the difference.
"The good news is hell is just the product of a morbid human imagination.
The bad news is, whatever humans can imagine, they can usually create." - Harmony Cobel
But I think setting the session duration to longer than 3600 seconds has 'fixed' the issue. So it seems to me its this setting that logs people out. I set it to the max setting yesterday as a test and I am still logged in today.
neither do I , however isn't that because the remember me is logging us in automatically when we load the first page of the board?
the session time logs us out after that number of seconds of inaction on the board.
If you have cookies disabled in the browser the SID appears in the URL, this is how you are identified as "logged in". As long as you are active for the session length it will remain valid. Same thing applies if you are not blocking cookies and do not check "Remember me" except it's stored in a cookie instead of the URL.
Precisely what happens when "Remember me" is checked I'm not quite sure if new session ID is issued or not. Basically that along with other cookie values are checked against those stored in the database to validate logged in user.
Extending the session length may help mask "Remember me" issues but it will not fix them. The session length is not total time but time since your last activity. Not sure what the maximum value is but if for example it exceeds 24 hour period as long as you have activity once a day on the forum you'll remain logged in. This time is kept short because there is potential security issues, for example someone is on a public computer. If the session length is long and they do not log out someone else using that computer can access their account in that time period despite the fact they did not check "Remember me". There is less possibility of that happening with shorter session length.
“Results! Why, man, I have gotten a lot of results! I have found several thousand things that won’t work.”
Well after some testing over the last couple of weeks I can confirm that simply ticking remember me does nothing to keep you logged in.
It must also work in conjunction with the session length time.
So if your session length time is 24 hours and you've ticked remember me, the forum keeps you logged in for 24 hours.
If you visit after 26 hours, you'll be logged out.
Not sure if anyone can check here what this phpbb forum uses but it cannot be the default settings as I am still logged in here after 10 days of no activity.