Invalid_Session

  • Netmaster
  • Expert
  • Expert
  • User avatar
  • Posts: 535
  • Loc: Saint Joseph, MO

Post 3+ Months Ago

Ok, I have a problem. I have to clear my cookies every time I want to post, or ill get an Invalid_Session message. Can anyone help me?
  • Anonymous
  • Bot
  • No Avatar
  • Posts: ?
  • Loc: Ozzuland
  • Status: Online

Post 3+ Months Ago

  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Posts: 23456
  • Loc: Woodbridge VA

Post 3+ Months Ago

What browser? What OS? And are you using multiple browser windows and/or computers all logged in at the same time? And do you have more than one account here?

I've had that problem in the last couple weeks, too. Not in the last 4 days. I thought it was just a glitch. Maybe not.

I do think I narrowed it down though. Not here, but at my own place I have several test accounts set up to work with the code and this usually happens when I log in as one of my test accounts in one browser window, but still am logged as myself in another. I think that's screwing up my session.

However, I did have that problem here twice within the last two weeks, and I only have this one account here. No clue what happened with that one. I went to post something...got the invalid session error and BAM! the post was gone and I hadn't copied 'em so had to redo them from scratch. I think I even posted that comment somewhere.
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Posts: 23456
  • Loc: Woodbridge VA

Post 3+ Months Ago

Yep -- here it is -- this is exactly the last time it happened to me here:

http://www.ozzu.com/viewtopic.php?t=18931

I know this forum code and I know there's not a timeout on the seesion if you are logged in and typing a reply, no matter how long it takes.

About 2/3 down the post you'll see where I lost my session and had to start from scratch.
  • Netmaster
  • Expert
  • Expert
  • User avatar
  • Posts: 535
  • Loc: Saint Joseph, MO

Post 3+ Months Ago

that has to suck man. I made a different account to see if I get the same thing awhile back, and yep. I dont understand it. Im using IE6 I believe and the OS is WindowsXP
  • Bigwebmaster
  • Site Admin
  • Site Admin
  • User avatar
  • Posts: 9090
  • Loc: Seattle, WA & Phoenix, AZ

Post 3+ Months Ago

The problem basically comes down to how PHPBB manages sessions and the fact that you use AOL. If you were to use a different ISP other than AOL you probably would not be having this problem.

This post at phpbb.com explains exactly why that problem is occurring:

http://www.phpbb.com/kb/article.php?article_id=54

I have also pasted it here:

Quote:
Originally in reply to INVALID SESSION

I'm going to explain the situation once more and then never again ...

phpBB uses sessions to "track" users as they move between pages, forums, topics, etc. A session is made up of a unique 32 character session_id which identifies the current users. This value is stored in the sessions table and either a temporary (i.e. it's deleted when the browser window is closed) cookie on the users machine or if that doesn't seem to be working it's appended to all URLs.

The problem with using just a session_id is that it becomes very easy to hijack (takeover) a session. All a user need do is obtain the session_id and add it to the url as they browse the board. If the id they grab happens to be a logged in admin or moderator ... well you get the picture.

What we do to help complicate the situation is also tie the session to the users IP. Using this method someone would need to spoof an IP and obtain the session_id in order to hijack a session, not incredibly difficult but certainly harder ... and with this sort of software it's really a case of making everything harder to do, thus disuading all but the most ardent "hackers" from bothering to attempt anything.

How do we obtain this IP? We check the availability of two variables, REMOTE_ADDR and HTTP_X_FORWARDED_FOR. Firstly we check for HTTP_X_ ..., this is typically set by "nice" proxies, caches, etc. and contains "an" IP which may be the users "real" IP or some other IP. If that does not exist or it contains a private or restricted IP range (several blocks of IPs are reserved by the international bodies responsible for IP allocation) we instead use the value contained in REMOTE_ADDR. This variable typically contains the users real IP.

However, problems arise with how some ISPs operate their systems. Instead of forwarding the users real IP or indeed a different but static IP they simply make available only the IP of the proxy being browsed. The larger ISPs do not use a single proxy or cache, the load upon it and data passing through it would be far too great. Instead they use several systems in a "proxy farm" (I tend to refer to it as something containing most of those letters ... ). A user browsing the web may be switched between these machines from one page to another (to help distribute load), with the IP changing as they go.

Obviously a problem then exists in that phpBB's ability to tie a users session to a unique id and an IP fails ... because the IP is constantly changing. There are some "nice" ISPs out there that run these farms within a single "class" or block of IPs, e.g. 1.2.3.4, 1.2.3.5, 1.2.3.6, etc.

This is why in a previous release of phpBB we introduced a slightly reduced IP checking system which now checks only the first three "quads" of an IP, i.e. 1.2.3.4 is checked only for 1.2.3 the 4 is discarded. Remember, that an IPv4 address is 32bits wide, this is generally presented in the form of four 8 bit numbers. By checking just the first three numbers (24bits) we neglect 8 bits or 255 (253 in practice) possible IPs ... that's 253 seperate potential proxies ... IOW enough machines for practically any ISP on the planet. However we can go further and reduce that checking to just the first "two quads", that ignores 255 * 253 IPs!

The problem is some ISPs don't arrange their IP allocation particularly well, either for historical or other reasons ... AOL is one significant culprit. So what happens is that users can jump between completely different Class A (this is a full 32bit block of IPs) networks, e.g. 100.100.100.100 to 200.100.40.40, etc. This renders IP validation completely useless for such situations

So you ask, "Okay, but why did 2.0.3 not cause all these Invalid_session errors?!". The answer is fairly simple. When you first visit phpBB (assuming you have autologin enabled) it looks to see if you have a session_id (either in a cookie or the URL). On a new visit you won't have such a session_id and so phpBB creates a new one. If you have autologin set it checks the relevant data and if that matches you are logged in with the appropriate user_id. You can then immediately browse the board, post messages, do admin tasks (if applicable), etc.

Now let's take a situation where a naughty person creates a bogus form on their site. You are (for some reason) browsing this form. However, unknown to you this form contains all the necessary data to delete a pile of topics in a given forum (you having moderator rights on a certain board). When you submit that form it will be transmitted to the appropriate website. No session exists so phpBB, as noted above creates a new one and immediately processes the form data ... all the relevant topics are deleted from the database and you only find out when the boards "The selected topics have been deleted" message appears ...

To help negate the effectiveness of this we backported some code from phpBB 2.2 and introduced additional code. The admin control panel now appends your session_id to every url. When you browse within that panel it checks the session_id in the url with that stored in the sessions table. If they match, great, if they don't it redirects you back to the ACP index. This will help prevent users accidently, without their knowledge suffering issues as noted above.

Similarly the Moderator control panel has the session_id appended to urls and carries out a check. The difference here is that it throws up an Invalid session if the ids do not match, note that redirection like the admin panel wouldn't alter the result here ... if you tried submitting data via the MCP with an invalid session you'd just be returned to MCP front page ... losing any data entered previously. Other issues with voting and posting were also addressed thanks to a concerned user notifying us. Thus similar checks were put in place there.

The problem is that for users whose session is forever being renewed due to their IP changing this extra level of checking can cause issues. For many ISPs the noted changing of 6 to 4 in the IP validation check will be sufficient ... however AOL crops up (as per usual in nearly all similar situations with all software ...) as the sore thumb.

"What can you do about it?" you may ask, very little is the response. We could remove the extra validation but that leaves a gap that frankly I'm not prepared to leave ... if hadn't addressed this I would make a handsome bet that at some near future point we would've had users shouting and screaming about how damage was done to their boards and why didn't we (phpBB) fix it if we knew about it

What else can we do? As I said, very little that won't impact users completely unaffected by this issue (of which I'm betting there are a great many) ... in phpBB 2.2 we are introducing a feature to set the level of IP validation by the ACP, including disabling it completely. However disabling IP validation will, as noted leave your users open to simplified hijacking. For many people this may not be a problem and thus could be a solution. To do this in phpBB 2.0 you need to either remove the validation code from sessions.php or change the 6 to a 0 (the relevant lines are as noted in this topic). Be aware of what you are doing though and keep quiet about it ... if people don't know IP validation isn't operational they may believe it still is. If you have security issues you can trace to users sessions being hijacked we don't want to know about it

We could introduce a change to sessions whereby what happens when a new session is created is "weakened". What do I mean by weakened? Well, at present we generate a new session whenever we cannot validate an existing one. Instead what we could do is compare the users current session_id (if they have one) with that in the database. If a match is found and the time differential is some "small" number we instead continue that session. The problem here is that it's just as open to hijacking as removing IP validation. Why? Because that check will ignore the users IP and care only about the session_id ... and thus isn't something I'm keen on without direct admin control.

We could, as per a new Mod listed elsewhere on the board, ignore IP validation whenever the users IP is within a given list. While this isn't as bad as removing validation completely it's not terribly far off. Why? Because instead of having to go to some trouble to obtain a users current IP you can instead (given you know a user connects via a given ISP or proxy) just look it up ... you still need to spoof it but a step has been removed ... and as noted previously all we can do is make these peoples lives harder. There are additional issues with the extra processing required (which may or may not be significant depending on the number of IPs, users browsing, etc.) and of keeping the list up to date.

We could append a random set of alphanumerics to every single page, changing the value of it with every page view and storing the new data in the sessions table. This would add protection because a hijacker would need not only the session_id but also the current unique identifier. Of all the ideas this is probably my favourite and may make it into a future release (unless I've missed something obvious which renders it useless or bad for performance!).

"Okay, fine but what can we do about it now?!" I hear you say. Well, you can remove or reduce validation as noted above (being aware of what you are doing), you could add the Mod noted above (you'll find it presently in another Invalid session topic ... no doubt it will be moved to one of the Mod forums in time) or finally you could remove the piece of code (from all affected pages) that looks like or similar to this:

Code: [ Select ]
// session id check
if ($sid == '' || $sid != $userdata['session_id'])
{
  message_die(GENERAL_ERROR, 'Invalid_session');
}
  1. // session id check
  2. if ($sid == '' || $sid != $userdata['session_id'])
  3. {
  4.   message_die(GENERAL_ERROR, 'Invalid_session');
  5. }


This removes the added security of validation so if you do this we aren't interested in any security related problems that may arise. I highly recommend that you do not remove the added security from the admin control panel.

There, that just about covers it I think ...


According to that article I could remove the piece of code which would probably resolve the problem for you, but it would lower the security of this board by a good deal. I am not prepared to do that at this time.
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Posts: 23456
  • Loc: Woodbridge VA

Post 3+ Months Ago

Thanks Bigwebmaster. I'll chaulk my glitches up to self-inflicted since I wouldn't dream of using AOL and I already somewhat know why it happened to me.
  • Netmaster
  • Expert
  • Expert
  • User avatar
  • Posts: 535
  • Loc: Saint Joseph, MO

Post 3+ Months Ago

so is there any way that I could fix this problem??
  • Bigwebmaster
  • Site Admin
  • Site Admin
  • User avatar
  • Posts: 9090
  • Loc: Seattle, WA & Phoenix, AZ

Post 3+ Months Ago

You could try using a proxy server to make your posts as long as it doesn't pass your real ip and the proxy server uses a static IP (not dynamic).

If not that, you could get rid of AOL and move to a real ISP :D

I believe your problem happens every time your connection changes to a new IP address that has a different class A number. AOL does this alot and that is the major problem you will probably find with any forum running PHPBB.
  • Netmaster
  • Expert
  • Expert
  • User avatar
  • Posts: 535
  • Loc: Saint Joseph, MO

Post 3+ Months Ago

Ill try that.. by the way, I use AOL Broadband.. its not really that bad..
  • UNFLUX
  • Genius
  • Genius
  • User avatar
  • Posts: 6376
  • Loc: twitter.com/unflux

Post 3+ Months Ago

Netmaster wrote:
I use AOL Broadband.. its not really that bad..

:lol: :lol: :lol: not THAT bad....hehe tickles me
  • Netmaster
  • Expert
  • Expert
  • User avatar
  • Posts: 535
  • Loc: Saint Joseph, MO

Post 3+ Months Ago

ha ha.. real funny UNFLUX.. not really..
  • b_heyer
  • Web Master
  • Web Master
  • User avatar
  • Posts: 4581
  • Loc: Maryland

Post 3+ Months Ago

Well it isn't that bad, you just can't get any worse :-P
  • Netmaster
  • Expert
  • Expert
  • User avatar
  • Posts: 535
  • Loc: Saint Joseph, MO

Post 3+ Months Ago

List 10 things that is wrong with aol
  • Bigwebmaster
  • Site Admin
  • Site Admin
  • User avatar
  • Posts: 9090
  • Loc: Seattle, WA & Phoenix, AZ

Post 3+ Months Ago

  1. Price
  2. Ads everywhere - popup ads, email ads, etc
  3. Email problems - doesn't conform to internet standards
  4. Privacy Issues
  5. Censorship
  6. Inferior access and software
  7. Billing problems
  8. Proxy servers (your problem here)
  9. Security
  10. Scam marketing
  • b_heyer
  • Web Master
  • Web Master
  • User avatar
  • Posts: 4581
  • Loc: Maryland

Post 3+ Months Ago

11. They have international sites...(AOL = America OnLine)
12. Their TV adds are the single most annoying thing.

Good things about AOL
1. Their junk mail makes for a great frisbee.
  • Netmaster
  • Expert
  • Expert
  • User avatar
  • Posts: 535
  • Loc: Saint Joseph, MO

Post 3+ Months Ago

I see your point BigWeb.. Maybe I should switch to another ISP.. Ill make a new Post asking for advice on which are the Forums Favorites..

Post Information

  • Total Posts in this topic: 16 posts
  • Users browsing this forum: No registered users and 3 guests
  • You cannot post new topics in this forum
  • You cannot reply to topics in this forum
  • You cannot edit your posts in this forum
  • You cannot delete your posts in this forum
  • You cannot post attachments in this forum
 
cron
 

© 1998-2014. Ozzu® is a registered trademark of Unmelted, LLC.