Every time I leave the site now, even for a millisecond, I'm automatically logged out. On the login-page, the "keep me logged in" box is checked. My cookies setting is the same "medium" that it's always been. Any idea what the problem is?
We switched the site to HTTPS earlier this month. There are a few mechanisms in place that should be forcing your browser to use the HTTPS version of the site. Look at the URL in your browser's address bar. Does it say 'secure' or https://? If you're getting logged out it means our site is either not able to set the login cookie or your browser is not sending it to the server.
I can not reply to the last topic i posted. I'm seemingly logged in on all other pages but on this page i'm constantly shown as logged off. Topic I've cleared cookies using the links but the problem persists. I'm on Firefox.
sir wankalot's post sounds somewhat similar to the discussions of this thread and this thread too. I just tested it again and problem still persists (yes I tried Drew's "Try this" above). To avoid the issue, I have trained myself to never open an ADT thread before logging in.
This was a clue for me. I made a change to the encoded caching HTTP Etag header that's sent to the browser in the page response. The change was to add the forum user ID as part of the data hash that generates the tag. So if you visit a topic when you are logged in vs. logged out your browser will see two different Etags. This will hopefully clear things up.
I find myself logged out about 3 days or so. I can't see what I'm differently on my end (running CCleaner or other things that might clear cache/cookies), so I don't know what's causing it.
My android device seems to be maintaining a persistent login, though it's been only a few days now. But that is still notable; previously I had to re-login every time I visited ADT.
On the morning of March 4th I changed the max-age setting for the Strict-Transport-Security server header from 1 day to 1 year. So unless you clear your cache your browser should remember that all of ADT should only be accessed with https. I also made some changes to the way that the server automatically attempts to force browsers to redirect to the secure versions of a page.
Posted - Feb 5 2017 : 11:25AM