Getting logged out of my forum software

[Ohso]

Hello, so I'm having strange issues with getting logged out of my phpbb3 forum. It's not so much random either... its predictable

Not when posting or browsing the forum, but when I'm in my admin control panel I seem to just loose my login session. Or (especially) if I trigger my custom 404 error page or some type of page that is rewritten using mod_rewrite.
eg; sitemap.php to sitemap.xml -- but never had a problem loosing my login session when entering custom pages that are rewritten until recently.

Also with custom error pages. I have set in .htcaccess ErrorDocument 404 /y_error.php?mode=404
for the custom page. if I trigger it, I get logged out of my board.

After a lot of testing around I think I've narrowed it down to my .htaccess. but I'm not 100% sure. So far, it seems, if a page is redirected because of .htaccess, it tends to log me out of my board.


But the strange part is that my entire board is using mod_rewrite for rewriting URL's and I don't get logged out. I actually never had a problem with that anyway.


All this starting happening about the time I found out we got moved to Apache servers and using Varnish.

I did extensive searching for my issue and bumped into support topics where people say setting php_value request_order GPC worked for them.
I've used php_value request_order GP or php_value request_order GPC and still no difference. actually still not sure if we're allowed to set that in our own .htaccess so I don't know if its working or not...

I've been using this forum software for years so I'm knowledgeable on how to set proper cookie settings and cookie domain settings.
Again, these logout issues only starting to happen after we moved from Lightspeed to Apache servers and Is why im posting this here.



Any ideas what could be wrong?

 

[Corey]

Try disabling the caching to rule that out, put this in your .htaccess

Header set Cache-Control "max-age=0, private, no-cache, no-store, must-revalidate"

 

[Ohso]

Thanks for replying, but I have that already in my .htaccess when I found out we had Varnish installed and I have tested without it too, just in case.

I also placed

php_flag register_globals Off
php_flag magic_quotes_gpc Off
php_value request_order GPC

But that doesn't seem to make too much a difference



I'll keep troubleshooting



Thanks

 

[ace_case]

Pretty much all of my urls are rewritten from something like read.php to just /read/. Those work fine with the session data, but if I visit or or load content that doesn't exist and get a 404, it clears my session. May be related, or it might just be a programming bug.

 

[Ohso]

Pretty much all of my urls are rewritten from something like read.php to just /read/. Those work fine with the session data, but if I visit or or load content that doesn't exist and get a 404, it clears my session. May be related, or it might just be a programming bug.

Yeah I get that too. I don't understand how a 404 error can log me out of my forum but so far it seems to be a mystery since I been trying a crap load of googling and asking around on different development sites.


At this point, it seems, I can hold a normal login session within my forum. An occasional logout, but once I log back in, I stay logged in for until I logout on my own.

I can be happy with that.

 

[leafypiggy]

You can also check http://isvarnishworking.com to see if the .htaccess modification is working. It should say "Yes! Sort of." and then you should see the Cache-Control header underneath.

 

[Ohso]

Yeah it's working and I checked on that site before, I think someone else mentioned that link on this forum when I was searching on why my css changes were not showing. I'm constantly modifying my css stylesheets and it's why I disabled Varnish for now. Varnish disabled or not, doesn't seem to change the behavior of the logouts.

Thanks for the reply