Why does CUK log you out when you lose your connection?

[Sysman]

Using Safari (on Mac) I get logged in automatically for months on end with any of the vBulletin sites I visit.

Does your IP address change frequently? Does it ever change in mid session?

[RichardCranium]

Does your IP address change frequently? Does it ever change in mid session?

Ooh! Good theory.

I shall investigate that possibility.

[Platypus]

Having said the other day that this "never happens to me"....

Well - it does now.

Only noticed this morning but I keep being logged out of CUK mid-session, almost as if there's an inactivity timer in operation!

RC - did you solve this?

I don't think it's my IP address changing because I have a VPN connection on another laptop connected all day to clientco and that doesn't drop.

[Sysman]

Ooh! Good theory.

I shall investigate that possibility.

Another thing to look at is cookies. I think that is how the login "Remember me" and sessions are tracked. The layout of cookies is clearly documented, um, somewhere out there.

[RichardCranium]

RC - did you solve this?

Not yet. I haven't been in a place with a sufficiently dodgy connection.

[RichardCranium]

Does your IP address change frequently? Does it ever change in mid session?

Aha!

When using the T-Mobile dongle in the car, it loses & re-establishes it connection fairly often. And each time gives me a different IP address.

So maybe that's it.

Now why don't the other sites I am logged into get upset at this?

[EternalOptimist]

blooming heck. happened to me today for the first time

a puzzle

[Gonzo]

Aha!

When using the T-Mobile dongle in the car, it loses & re-establishes it connection fairly often. And each time gives me a different IP address.

So maybe that's it.

Now why don't the other sites I am logged into get upset at this?

Short outages are a regular feature of the service provided by the ISP I am using out here and I find that I get logged out after every interuption, I don't use the "remember me" option though. I suspect that I get a new IP address each time that happens but have not investigated thoroughly.

I am on another forum that uses vBulletin 3.7.3 where I do use the "remember me" option and I am always logged on when I look at that one.

[NickFitz]

FWIW, there are (sort-of) two kinds of cookies (cookies being what vBulletin uses to keep you logged in). There are session cookies, which have an expiration date in the past and are only held in memory (that is, although they might be written to disk in a swapfile if you aren't in "PornMode", they aren't stored in the place the browser keeps cookies) and are used when you login without "Remember me"; and persistent cookies, used when you do use "Remember me", which are written to disk in the place the browser keeps cookies (rather than just incidentally in a swapfile) and are removed when their expiry date comes around some time in the future. (The expiration date is normally reset to "a year from now" or some such value each time they are received by the server as evidence that you wanted to stay logged in.)

Given the number of people who post/register here in a trollish manner, and further given that we know that admin keeps track of IP addresses that are used for improper purposes, it is possible that CUK's tracking of login cookies even with the "Remember me" option (which should persist in the same browser after an IP address change on the same computer) has been modified to detect IP address changes, probably in the attempt to keep some trollfest under control. This would lead to the symptoms described. For example, RC's enforced logouts when the IP address is changing regularly is obviously explained; whereas EO's experience of the same thing could happen because his ISP uses DHCP (~99.999% likelihood) and it happens to have given him a new address on the latest renewal.

The latter does happen: I have some virtual servers on Amazon EC2 which only allow logins over services other than SSH from specified IP addresses. Every few months, Virgin - which usually gives me the same IP address even if I've been away for a week - will switch to another one, and I have to go in over SSH to remove the old address and authorise the new one

If CUK's login cookies have somehow been tied to IP addresses even when non-session (i.e. persistent), it would explain both RC's repeating problem and EO's first encounter therewith, in that EO's ISP has given him a different IP on the most recent occasion that his CUK-facing-system(s) - probably his broadband modem - sought to renew/establish a DHCP lease.

But of course, this is just a theory