Member gets logged into other accounts?

[beerForo]

Not sure if this helps. Maybe you can disable Varnish or LiteSpeed to rule them in or out.

XF 2.0 - Random Users Logged in for Visitors

I've gotten a few reports from people going to register that when the visit the domain it shows the forum listing and it is "logged in" as a random user. But whenever they click on a forum, link, or anything it gives them a security error and redirects to the login page (guests have no access to...

xenforo.com

 

[Ludachris]

So, I tried that URL. It did make it to the web server... however, the page changed. I was looking at the forums index page and it redirected to the site homepage (an XF page I have set in options). That homepage displays as if I'm not logged in. It shows the Login link. If I go to another page in the forums I'm displayed as logged in. If I go back to the forums index page I'm displayed as that other member still.

I made sure that all add-ons are updated (I'm not using any add-ons on this site that I'm not using on my other XF installations) as well as XF itself.

 

[Ludachris]

Not sure if this helps. Maybe you can disable Varnish or LiteSpeed to rule them in or out.

XF 2.0 - Random Users Logged in for Visitors

I've gotten a few reports from people going to register that when the visit the domain it shows the forum listing and it is "logged in" as a random user. But whenever they click on a forum, link, or anything it gives them a security error and redirects to the login page (guests have no access to...

xenforo.com

The host told me the server isn't using those.

 

[beerForo]

One more fyi

XF 1.5 - Possible Security Issue

Hi, I moved from vB5 to Xenforo recently and it has been a huge success, but yesterday a new user posted claiming to have been randomly logged in as two different users, one of whom is a mod. They posted proof that they had indeed had Moderator level access, so I'm happy that they aren't just...

xenforo.com

 

[digitalpoint]

Well if the request is making it to your web server, you probably are going to need to get your server administrator involved. Sounds like maybe you have some sort of caching going on at the web server level. Cloudflare isn't caching it and the request is making it to your web server, so it's not some other front-end cache. So it's either the web server or the application (XenForo). You may want to disable all XenForo addons just as a test to be certain it's not something going on in XenForo.

You may want to check your XenForo config.php to see if XenForo guest page caching was enabled. But if it was, you'd see an HTTP response header letting you know that it came from XenForo's guest page cache. Specifically you would see an HTTP header along the lines of X-XF-Cache-Status: HIT.

See: https://xenforo.com/docs/xf2/cache/#guest-page-caching

 

[Ludachris]

So, I tried that URL. It did make it to the web server... however, the page changed. I was looking at the forums index page and it redirected to the site homepage (an XF page I have set in options). That homepage displays as if I'm not logged in. It shows the Login link. If I go to another page in the forums I'm displayed as logged in. If I go back to the forums index page I'm displayed as that other member still.

I made sure that all add-ons are updated (I'm not using any add-ons on this site that I'm not using on my other XF installations) as well as XF itself.

So something changed... I just refreshed the forum index URL with the extra string at the end. Now it loads the forum index with my user account. Without the string, it displays the other user account. So what would that mean?

 

[beerForo]

Are both https?

This setting should be checked:
Enable board URL canonicalization

 

[digitalpoint]

Might have a reverse proxy in play somewhere. Usually the http headers will give some clues if something like Varnish being used somewhere. But you are probably going to need to do a lot of individually simple things to try and track down where in the request stream it is. Checking headers, checking if individual requests are making it to web server, etc.

You really probably need the server admin to get involved. There’s only so many tips/pointers that can be given about things you might want to check when we don’t know what the site is. It’s going to be a lot easier to have server admin checking all the things rather than going back and forth. There’s a lot of things to check and each of those things are dependent on other checks. So you’ll save yourself a lot of time just letting someone go digging that actually has access to check all the things.

 

[Ludachris]

Are both https?

This setting should be checked:
Enable board URL canonicalization

Yes, and that option is checked.

 

[i_n_k]

Yes, and that option is checked.

I had a similar issue a while back with Cloudflare. My advice would be to create a custom setting in Cloudflare to limit caching to images, attachments, etc. only for your forum.

It's tougher with forums because, unlike a blog, website, etc., a board isn't as static, it changes moment-to-moment, so it makes more sense to cache only the items that are static (avatars, site images, attachments, etc.) rather than have it cache every one of the forum posts/threads, pages, etc.

 

[Ludachris]

I had a similar issue a while back with Cloudflare. My advice would be to create a custom setting in Cloudflare to limit caching to images, attachments, etc. only for your forum.

It's tougher with forums because, unlike a blog, website, etc., a board isn't as static, it changes moment-to-moment, so it makes more sense to cache only the items that are static (avatars, site images, attachments, etc.) rather than have it cache every one of the forum posts/threads, pages, etc.

Any idea how the rule would be structured to achieve that? I'm not sure why I haven't had this issue with my other sites that use Cloudflare.

 

[Ludachris]

I should mention that I disabled add-ons via the config file just to rule that out too.

 

[digitalpoint]

Any idea how the rule would be structured to achieve that? I'm not sure why I haven't had this issue with my other sites that use Cloudflare.

If you aren’t getting the Cloudflare cache HIT header, you can rule out that it’s Cloudflare caching it so you don’t need to go digging through your Cloudflare config.

 

[Ludachris]

I appreciate all the replies trying to help out, by the way. Much appreciated. I'm reaching out to a developer/server admin contractor I've used in the past to see if he can help. I'm still at a loss at this point.

 

[Suzanne O]

Check to see if the other member is an admin and has more controls than what you do.
Otherwise change your password and clear your cache and see if that works

 

[Ludachris]

Check to see if the other member is an admin and has more controls than what you do.
Otherwise change your password and clear your cache and see if that works

Nope. I'm the only Admin. Also, as noted earlier, it's happening to everyone on the site from what I can tell, not just me. Cache has been cleared in my browser, and others have tried the same. I've purged the cache in Cloudflare and have checked everything everyone has suggested, no other website front end cache running. It makes no sense how it can be happening to all members, and they/we are all seeing the same thing/same member, a member with no special access. And it just started all of the sudden last week with no changes being made. Nobody seems to know what could be causing it.

 

[Suzanne O]

Are they unchecking the remember me password box?
make sure that's checked.
Sounds like you have to rebuild the cache

 

[Suzanne O]

Admincp > tools > rebuild user cache

 

[TPerry]

And it just started all of the sudden last week with no changes being made. Nobody seems to know what could be causing it.

Did you by chance install (or upgrade) any add-ons prior to it happening?
Have you tried it with add-ons disabled?
Are you using any add-ons that let you log on as another user?

Not sure if you are on shared hosting or a VPS/dedi, but have you actually tried restarting the HTTP/PHP/caching processes for the server if you can?

 

[Ludachris]

Did you by chance install (or upgrade) any add-ons prior to it happening?
Have you tried it with add-ons disabled?
Are you using any add-ons that let you log on as another user?

Not sure if you are on shared hosting or a VPS/dedi, but have you actually tried restarting the HTTP/PHP/caching processes for the server if you can?

No upgrades to anything when it started happening. Tried disabling add one as noted earlier. No add ons that allow you to login as another user. No add ons that I’m not also running on other forums. Again, tried disabling them. It’s a dedicated server running Apache. I haven’t rebooted the server yet but there are no caching systems in place for the website on the front end. And this issue isn’t happening on the other XF sites on the server. It doesn’t make any sense.