phpBB ip address validation

[[Dimetrodon]]

You said "whole point is to tell accounts apart" which is not what this is.

If multiple sessions from the same IP address come in then they must be distinguished - especially when they're logged in. You don't want anyone to be logged in as someone else, hence "accounts". I was not talking about logins, only sessions.

I am just going to reply to this here if you don't mind. I have been on an old phpBB 3.0.x board that does not have ip session validation and it is a lot more active than phpBB.com. No one gets logged into anyone else's account or session nor was anyone hacked. All that has occurred is that users with rapidly changing ip addresses don't have problems.

I don't need to use a proxy though. I'm surprised, but the "Remember me" checkbox seems to mitigate my problem, just making sure my browser accepts cookies as well.

I do still assert that phpBB's settings strike me as one of the most "harsh" (if that's the right word) on such enforcement.

[Mick]

Let me know if I’m wrong but you’re the only user here having the issue.

[[Dimetrodon]]

But, let me know if I’m wrong, you’re the only user having this issue.

Had. Clicking "Remember me" took care of it, at least in my case.

Sure, I'm the only one who had this problem recently on this site, but I'm not the only one who has had this issue on phpBB board. I have read older topics of people who also had this issue as well. Some even having the issue on their own boards.

[Mick]

What gives you the ideas it’s to do with IP validation? I use lots of different IPs and always have but I don’t have to login in all the time. It’s beyond me.

[[Dimetrodon]]

What gives you the ideas it’s to do with IP validation? I use lots of different IPs and always have but I don’t have to login in all the time. It’s beyond me.

Two reasons. When looking up why it is happening topics that were solved by changing IP validation settings came up. The problems stated were identical to mine.

When I had the problem on one of my own boards, disabling validation solved the problem.

[Mick]

Was that just you or all of your users? I mean if it was an issue with the settings here there’d be tons of groans and there’s not. As has been said the users safety won’t be compromised for just one case especially as the issue appears to be at your end. Maybe see if T-Mobile has an answer? Incidentally, I’ve just forced an IP change with no issues, I’m still logged in.

[[Dimetrodon]]

As has been said the users safety won’t be compromised for just one case especially as the issue appears to be at your end.

That has been said to me curtly many times here. All I'm saying is that disabling it doesn't cause the phpBB software to confuse sessions with other users which is the post I was responding to. I'm disagreeing with another user, nothing more.

I’ve just forced an IP change with no issues, I’m still logged in.

If I was to guess, the setting here is A.B and not A.B.C. You probably wouldn't still be logged in if it was A.B.C. unless you have "Remember me" checked. Thankfully, someone did lower the setting here recently to A.B as, I am able to get passed the login screen now without getting 50 "The submitted form is invalid" messages.

As for my issue with the super-harsh A.B.C. set phpBB boards: I solved my own problem. "Remember me" fixes this problem of staying logged in.

After playing around a bit. A.B seems to be a reasonable middle ground.

[[Dimetrodon]]

Just for the record, T-Mobile is not going to change how IPs are distributed or cycled. I'm not going to pretend to be an expert on networking, but from what I can gather, doing so would require overhauling parts of their entire network and would cost billions.

[Lumpy Burgertushie]

also, "remember me" does not keep you logged in. it simply logs you in automatically the next time you visit after your session expires.
If you remain inactive on the board long enough for your session to expire then it will log you back in as soon as you click on anything.

I don't know how this may affect the issue you are having, just a little fyi.


robert

[[Dimetrodon]]

it simply logs you in automatically the next time you visit after your session expires.

It creates a new session so when I get kicked out due to IP changes, it creates a new one with my IP and sticks with me.

I still find A.B.C to be annoying but I think I understand how "Remember me" mitigates it.

[Mike-on-Tour]

Strangely I experienced the same situation yesterday two times when writing a reply in my extensions support forum.
I opened the new topic, clicked the response button, wrote the answer and clicked on the peview button only to be logged out, had twice to log in again (the first time had an unvalid form response) and had to do the whole thing again. Same with the second new topic.
And I've never had any difficulties.

[[Dimetrodon]]

Do you normally click "remember me" on the login screen? That should prevent future unexpected logouts.

[Mike-on-Tour]

No, I don't. And never had any problems.