expanserpb
Active member
Removed the Clearsitedata() call from my installation for now
Browser issue Session does not close with Chrome
- Thread starter soloarquitectura
- Start date
What are the consequences of doing this?
expanserpb
Active member
I'm certain the developers won't recommend it and you'll have to make a risk-based decision.
developer.mozilla.org
The xenforo login.php calls up Clear-Site-Data: "cache" on logout.
My users have multiple accounts, so clearing the local cache on switch isnt great for me anyway (roleplay forum) and became unusable on chrome (with a regular complete clear out of local cache seemingly getting rid of the bug in Chrome but only temporarily)
I decided, based on how my users use the forum that the risk of someone sharing a computer and windows/mac login session and suffering a compromise of confidentiality of cached content was significantly less than the compromise of availability for 30 seconds every time a user switches account. This is based on the context of my site (roleplay site with an account switch Addon and little role-based segregation and private, sensitive content)
Clear-Site-Data - HTTP | MDN
The Clear-Site-Data header clears browsing data (cookies, storage, cache) associated with the requesting website. It allows web developers to have more control over the data stored by a client browser for their origins.
developer.mozilla.org
The xenforo login.php calls up Clear-Site-Data: "cache" on logout.
My users have multiple accounts, so clearing the local cache on switch isnt great for me anyway (roleplay forum) and became unusable on chrome (with a regular complete clear out of local cache seemingly getting rid of the bug in Chrome but only temporarily)
I decided, based on how my users use the forum that the risk of someone sharing a computer and windows/mac login session and suffering a compromise of confidentiality of cached content was significantly less than the compromise of availability for 30 seconds every time a user switches account. This is based on the context of my site (roleplay site with an account switch Addon and little role-based segregation and private, sensitive content)
Last edited:
maxicep
Active member
from Xenforo Core ?
I'm finding a solution for this Because of I've facing that issue too.
This is beyond annoying... I'm running Chrome 77.0.3865.90 64 bit too. I didn't know what do do other than to remove the offending line, so I did for Chrome, though still run it for non-Chrome browsers (I tested the following on Edge, Firefox, and Chrome).
I edited /src/XF/Controller/Plugin, function logoutVisitor()
and changed:
$this->clearSiteData();
to:
if (!stristr($_SERVER['HTTP_USER_AGENT'], 'Chrome') or stristr($_SERVER['HTTP_USER_AGENT'], 'Edge')) $this->clearSiteData();
(Edge's useragent includes 'Chrome' in it, so I needed to carve that one out too.).
Now Chrome doesn't hang any more
At least not until the next XF update.
I edited /src/XF/Controller/Plugin, function logoutVisitor()
and changed:
$this->clearSiteData();
to:
if (!stristr($_SERVER['HTTP_USER_AGENT'], 'Chrome') or stristr($_SERVER['HTTP_USER_AGENT'], 'Edge')) $this->clearSiteData();
(Edge's useragent includes 'Chrome' in it, so I needed to carve that one out too.).
Now Chrome doesn't hang any more
At least not until the next XF update.
maxicep
Active member
Yes i want to apply that but How can i clear (pass) the file healt check error on admin cp then?This is beyond annoying... I'm running Chrome 77.0.3865.90 64 bit too. I didn't know what do do other than to remove the offending line, so I did for Chrome, though still run it for non-Chrome browsers (I tested the following on Edge, Firefox, and Chrome).
I edited /src/XF/Controller/Plugin, function logoutVisitor()
and changed:
$this->clearSiteData();
to:
if (!stristr($_SERVER['HTTP_USER_AGENT'], 'Chrome') or stristr($_SERVER['HTTP_USER_AGENT'], 'Edge')) $this->clearSiteData();
(Edge's useragent includes 'Chrome' in it, so I needed to carve that one out too.).
Now Chrome doesn't hang any more
maxicep
Active member
It is basically easy way but i'm looking the professional way to clear that error. For example, i edit the hashes.json file after edit some files of any add-on and it pass the file health.
AnjaC
Active member
Hi there,
i have no Controller/Plugin, just ControllerPlugin but no file with the name "function logoutVisitor()". Any hint where to find this?
Thanks!
i have no Controller/Plugin, just ControllerPlugin but no file with the name "function logoutVisitor()". Any hint where to find this?
Thanks!
This is beyond annoying... I'm running Chrome 77.0.3865.90 64 bit too. I didn't know what do do other than to remove the offending line, so I did for Chrome, though still run it for non-Chrome browsers (I tested the following on Edge, Firefox, and Chrome).
I edited /src/XF/Controller/Plugin, function logoutVisitor()
and changed:
$this->clearSiteData();
to:
if (!stristr($_SERVER['HTTP_USER_AGENT'], 'Chrome') or stristr($_SERVER['HTTP_USER_AGENT'], 'Edge')) $this->clearSiteData();
(Edge's useragent includes 'Chrome' in it, so I needed to carve that one out too.).
Now Chrome doesn't hang any more
AnjaC
Active member
est3ban129
Active member
same here
expanserpb
Active member
Their stance is "this is a browser bug we're not changing anything" I think.
Though the browser bug goes back years I believe.
I've just hacked out the cache clearing from my files.
Though the browser bug goes back years I believe.
I've just hacked out the cache clearing from my files.
Ozzy47
Well-known member
You can fix this yourself to fix chrome’s bug, follow the instructions in this post, https://xenforo.com/community/threads/session-does-not-close-with-chrome.167665/page-2#post-1375796
NealC
Well-known member
I'm doing so now but this should have been in an update which could always revert later if needed. I prefer not changing source code and leave it to the vendor to handle this properly.
Masetrix
Well-known member
Why should "XenForo" ignore standards to fix Chrome? The patch published earlier could cause unwanted side effects, which would then be attributed to "XenForo". If you do not want to apply the patch above, you should contact Google and tell the problem and ask them to solve the problem. This is the right way.
Similar threads
- Question
- Question