invalid_session

Announcements and instructions regarding the board
Post Reply
User avatar
tokyo vogue
Posts: 146
Joined: Tue Jun 03, 2003 8:05 pm
Location: philadelphia

invalid_session

Post by tokyo vogue »

what the hell?

i get it every time i post a reply. every time, which is why i'm almost completely absent from the board. can't post except for new threads, which is pointless if you want to join a conversation. i'm having a hard time getting this through, too. if you read this, this is the nth time i've tried to post this godforsaken (literally) thread.


i tried the phpBB website, but their bugs section is almost completely useless. i fiddled through the source code, but couldn't find anything. i tried re-registering under a different name, but i got 'invalid_session' again.

that is to say: i kicked it, and it's still broke.

is this a problem on my end, and if so, what can i do to fix it? i really really enjoy this board, and it really pisses me off that i'm being kept out. i keep leaving for a few days, then coming back, hoping that it's stopped. no luck.



yours in perpetual annoyance,

tokyo
if we can rock together, why can't we walk together?
User avatar
bambooneedle
Posts: 4533
Joined: Tue Jun 03, 2003 4:02 pm
Location: a few thousand miles south east of Zanzibar

Post by bambooneedle »

http://nergal.hostmatix.com/~eucjw/phpBB2/index.php is better than http://www.elviscostellofans.com/phpBB2 Doesn't require logging in more than once. Even better if you tick that box upon logging in (for automatic subsequent log-ins).
User avatar
A rope leash
Posts: 1835
Joined: Fri Jun 13, 2003 6:47 pm
Location: southern misery, USA

Gate's wonder

Post by A rope leash »

Thanks for the tip, Bamb.

What I do in case of an invalid session is cut and paste back and forth from notepad or Word. On bigger entries, I start with notepad or Word, and cut and paste to the board. Invalid sessions are time related, I believe, so if you're in and out quick, it won't happen.

What do they mean "invalid"? Who are they to say I'm invalid? "Invalid"? I'll give you invalid...
User avatar
sulkygirl
Posts: 531
Joined: Thu Jun 05, 2003 2:22 pm
Location: The Absolute Armpit of the USA--Yakima, Washington (***cough***)

Post by sulkygirl »

Let's see...

Had to miss work today (***sigh***)...I've been having the same issues, and many more>>>

sulkkygirl
"Love can be stranger than fiction..."
User avatar
LessThanZero
Posts: 1119
Joined: Wed Jun 04, 2003 10:26 pm
Location: Kalamazoo
Contact:

Post by LessThanZero »

but how come i can post all the time at work, but at home, i'm always an invalid?
Loving this board since before When I Was Cruel.
User avatar
migdd
Posts: 3009
Joined: Sun Jun 22, 2003 6:16 pm
Location: Rolling in Clover, SC

Post by migdd »

LTZ - the same happens for me. I can post at work but not at home!
User avatar
migdd
Posts: 3009
Joined: Sun Jun 22, 2003 6:16 pm
Location: Rolling in Clover, SC

Post by migdd »

Never mind! After 3 weeks of not being able to post at home, I'm unexplainably able to post from home!!!
User avatar
DrSpooky
Site Admin
Posts: 822
Joined: Sun Oct 19, 2003 7:31 pm
Location: Huntsville, Alabama
Contact:

Post by DrSpooky »

<0 .. are you on a high speed connection at work and a dial up at home?

Or maybe you post quickly at work and take more time to do deep thought proving posts from home. :D
User avatar
Uncomplicated
Posts: 97
Joined: Tue Jun 03, 2003 12:38 pm
Location: It's in your eyes.... it's in your eyes....

aarrrggghhh!!!

Post by Uncomplicated »

aarrrggghhh!!!
It's in your eyes..... It's in your eyes.....
User avatar
Uncomplicated
Posts: 97
Joined: Tue Jun 03, 2003 12:38 pm
Location: It's in your eyes.... it's in your eyes....

Post by Uncomplicated »

It suck beyond sucking that I can post here at work but not at home!!!

#@$%#@&*!!
Last edited by Uncomplicated on Mon Nov 10, 2003 12:16 pm, edited 1 time in total.
It's in your eyes..... It's in your eyes.....
User avatar
so lacklustre
Posts: 3183
Joined: Tue Jun 03, 2003 2:36 pm
Location: half way to bliss

Post by so lacklustre »

Not Uncomplicated at all.
signed with love and vicious kisses
User avatar
Uncomplicated
Posts: 97
Joined: Tue Jun 03, 2003 12:38 pm
Location: It's in your eyes.... it's in your eyes....

help

Post by Uncomplicated »

just checking
It's in your eyes..... It's in your eyes.....
User avatar
Uncomplicated
Posts: 97
Joined: Tue Jun 03, 2003 12:38 pm
Location: It's in your eyes.... it's in your eyes....

wow

Post by Uncomplicated »

wow....it worked....will it work twice in a row???
It's in your eyes..... It's in your eyes.....
User avatar
Uncomplicated
Posts: 97
Joined: Tue Jun 03, 2003 12:38 pm
Location: It's in your eyes.... it's in your eyes....

Kick Ass!

Post by Uncomplicated »

YYYYYeeeeeeaaaaaahhhhhhh!!!!!!!!!!!!!!!!!!! I'M BACK!!!!!!!!!!
It's in your eyes..... It's in your eyes.....
User avatar
Mr. Average
Posts: 2031
Joined: Sat Jun 28, 2003 12:22 pm
Location: Orange County, Californication

Post by Mr. Average »

I had precisely the same problem. It was insane. I finally gave up, and my absence from the board was NOT that I had grown disinterested in the main or collateral subjects, but because I couldn't stand the constant rejection of the "invalid session" message which literally purges your posting.

And I hate it when my post gets purged...as far as internet forums are concerned.

Finally, I re-registered as screen name "Verbal Kint" using the same password as "Mr. Average" (me). Now, I can log on as Verbal Kint with my password, and low and behold, all my posting are credited to Mr. Average (still me), and the invalid session monster has yet to visit once. So I am sort of a ghost writer for Verbal Kint, or maybe it is the other way around, Verbal Kint is a ghost writer for Mr. Average.

Try a slight variation on your current screen name, and use the same password that formerly worked. It seems to have me unlocked, and, unfortunately, able to again post...post like the wind.

Remember: the greatest trick the devil ever pulled was convincing the world that he doesn't exist. I don't know how that fits, but I always wanted to slip that in to one of my postings, so I did.

Mr. Average
User avatar
Uncomplicated
Posts: 97
Joined: Tue Jun 03, 2003 12:38 pm
Location: It's in your eyes.... it's in your eyes....

invalid session

Post by Uncomplicated »

as I went to re-register, I got the Invalid Session error.... :cry:
It's in your eyes..... It's in your eyes.....
User avatar
Uncomplicated
Posts: 97
Joined: Tue Jun 03, 2003 12:38 pm
Location: It's in your eyes.... it's in your eyes....

invalid session

Post by Uncomplicated »

I'm obviously still struggling with this problem. I'm switching ISP's.....looks like that has helped.

I found this at the phpbb website.

Originally in reply to INVALID SESSION

I'm going to explain the situation once more and then never again ...

phpBB uses sessions to "track" users as they move between pages, forums, topics, etc. A session is made up of a unique 32 character session_id which identifies the current users. This value is stored in the sessions table and either a temporary (i.e. it's deleted when the browser window is closed) cookie on the users machine or if that doesn't seem to be working it's appended to all URLs.

The problem with using just a session_id is that it becomes very easy to hijack (takeover) a session. All a user need do is obtain the session_id and add it to the url as they browse the board. If the id they grab happens to be a logged in admin or moderator ... well you get the picture.

What we do to help complicate the situation is also tie the session to the users IP. Using this method someone would need to spoof an IP and obtain the session_id in order to hijack a session, not incredibly difficult but certainly harder ... and with this sort of software it's really a case of making everything harder to do, thus disuading all but the most ardent "hackers" from bothering to attempt anything.

How do we obtain this IP? We check the availability of two variables, REMOTE_ADDR and HTTP_X_FORWARDED_FOR. Firstly we check for HTTP_X_ ..., this is typically set by "nice" proxies, caches, etc. and contains "an" IP which may be the users "real" IP or some other IP. If that does not exist or it contains a private or restricted IP range (several blocks of IPs are reserved by the international bodies responsible for IP allocation) we instead use the value contained in REMOTE_ADDR. This variable typically contains the users real IP.

However, problems arise with how some ISPs operate their systems. Instead of forwarding the users real IP or indeed a different but static IP they simply make available only the IP of the proxy being browsed. The larger ISPs do not use a single proxy or cache, the load upon it and data passing through it would be far too great. Instead they use several systems in a "proxy farm" (I tend to refer to it as something containing most of those letters ... ). A user browsing the web may be switched between these machines from one page to another (to help distribute load), with the IP changing as they go.

Obviously a problem then exists in that phpBB's ability to tie a users session to a unique id and an IP fails ... because the IP is constantly changing. There are some "nice" ISPs out there that run these farms within a single "class" or block of IPs, e.g. 1.2.3.4, 1.2.3.5, 1.2.3.6, etc.

This is why in a previous release of phpBB we introduced a slightly reduced IP checking system which now checks only the first three "quads" of an IP, i.e. 1.2.3.4 is checked only for 1.2.3 the 4 is discarded. Remember, that an IPv4 address is 32bits wide, this is generally presented in the form of four 8 bit numbers. By checking just the first three numbers (24bits) we neglect 8 bits or 255 (253 in practice) possible IPs ... that's 253 seperate potential proxies ... IOW enough machines for practically any ISP on the planet. However we can go further and reduce that checking to just the first "two quads", that ignores 255 * 253 IPs!

The problem is some ISPs don't arrange their IP allocation particularly well, either for historical or other reasons ... AOL is one significant culprit. So what happens is that users can jump between completely different Class A (this is a full 32bit block of IPs) networks, e.g. 100.100.100.100 to 200.100.40.40, etc. This renders IP validation completely useless for such situations

So you ask, "Okay, but why did 2.0.3 not cause all these Invalid_session errors?!". The answer is fairly simple. When you first visit phpBB (assuming you have autologin enabled) it looks to see if you have a session_id (either in a cookie or the URL). On a new visit you won't have such a session_id and so phpBB creates a new one. If you have autologin set it checks the relevant data and if that matches you are logged in with the appropriate user_id. You can then immediately browse the board, post messages, do admin tasks (if applicable), etc.

Now let's take a situation where a naughty person creates a bogus form on their site. You are (for some reason) browsing this form. However, unknown to you this form contains all the necessary data to delete a pile of topics in a given forum (you having moderator rights on a certain board). When you submit that form it will be transmitted to the appropriate website. No session exists so phpBB, as noted above creates a new one and immediately processes the form data ... all the relevant topics are deleted from the database and you only find out when the boards "The selected topics have been deleted" message appears ...

To help negate the effectiveness of this we backported some code from phpBB 2.2 and introduced additional code. The admin control panel now appends your session_id to every url. When you browse within that panel it checks the session_id in the url with that stored in the sessions table. If they match, great, if they don't it redirects you back to the ACP index. This will help prevent users accidently, without their knowledge suffering issues as noted above.

Similarly the Moderator control panel has the session_id appended to urls and carries out a check. The difference here is that it throws up an Invalid session if the ids do not match, note that redirection like the admin panel wouldn't alter the result here ... if you tried submitting data via the MCP with an invalid session you'd just be returned to MCP front page ... losing any data entered previously. Other issues with voting and posting were also addressed thanks to a concerned user notifying us. Thus similar checks were put in place there.

The problem is that for users whose session is forever being renewed due to their IP changing this extra level of checking can cause issues. For many ISPs the noted changing of 6 to 4 in the IP validation check will be sufficient ... however AOL crops up (as per usual in nearly all similar situations with all software ...) as the sore thumb.

"What can you do about it?" you may ask, very little is the response. We could remove the extra validation but that leaves a gap that frankly I'm not prepared to leave ... if hadn't addressed this I would make a handsome bet that at some near future point we would've had users shouting and screaming about how damage was done to their boards and why didn't we (phpBB) fix it if we knew about it

What else can we do? As I said, very little that won't impact users completely unaffected by this issue (of which I'm betting there are a great many) ... in phpBB 2.2 we are introducing a feature to set the level of IP validation by the ACP, including disabling it completely. However disabling IP validation will, as noted leave your users open to simplified hijacking. For many people this may not be a problem and thus could be a solution. To do this in phpBB 2.0 you need to either remove the validation code from sessions.php or change the 6 to a 0 (the relevant lines are as noted in this topic). Be aware of what you are doing though and keep quiet about it ... if people don't know IP validation isn't operational they may believe it still is. If you have security issues you can trace to users sessions being hijacked we don't want to know about it

We could introduce a change to sessions whereby what happens when a new session is created is "weakened". What do I mean by weakened? Well, at present we generate a new session whenever we cannot validate an existing one. Instead what we could do is compare the users current session_id (if they have one) with that in the database. If a match is found and the time differential is some "small" number we instead continue that session. The problem here is that it's just as open to hijacking as removing IP validation. Why? Because that check will ignore the users IP and care only about the session_id ... and thus isn't something I'm keen on without direct admin control.

We could, as per a new Mod listed elsewhere on the board, ignore IP validation whenever the users IP is within a given list. While this isn't as bad as removing validation completely it's not terribly far off. Why? Because instead of having to go to some trouble to obtain a users current IP you can instead (given you know a user connects via a given ISP or proxy) just look it up ... you still need to spoof it but a step has been removed ... and as noted previously all we can do is make these peoples lives harder. There are additional issues with the extra processing required (which may or may not be significant depending on the number of IPs, users browsing, etc.) and of keeping the list up to date.

We could append a random set of alphanumerics to every single page, changing the value of it with every page view and storing the new data in the sessions table. This would add protection because a hijacker would need not only the session_id but also the current unique identifier. Of all the ideas this is probably my favourite and may make it into a future release (unless I've missed something obvious which renders it useless or bad for performance!).

"Okay, fine but what can we do about it now?!" I hear you say. Well, you can remove or reduce validation as noted above (being aware of what you are doing), you could add the Mod noted above (you'll find it presently in another Invalid session topic ... no doubt it will be moved to one of the Mod forums in time) or finally you could remove the piece of code (from all affected pages) that looks like or similar to this:
Code:

// session id check
if ($sid == '' || $sid != $userdata['session_id'])
{
message_die(GENERAL_ERROR, 'Invalid_session');
}


This removes the added security of validation so if you do this we aren't interested in any security related problems that may arise. I highly recommend that you do not remove the added security from the admin control panel.

There, that just about covers it I think ...
_________________
Paul S. Owen - Development Team Leader, phpBB
It's in your eyes..... It's in your eyes.....
Post Reply