Problems on login

[uwe]

Hello,

I have a strange problem, whenever i login, with correct user name and password (log table shows correct login), im always brought back to the login page, it returns 302 Found ! i.e:

POST index.php --->
302 admin/index.php <------
---->GET admin/index
302 index.php <---------
---->GET index.php
200 OK <-----------
This is an older build, RC4 (yes, yes, i will upgrade when i can) , march 2008! all users come from a single ip (gateway of campus lan).

This then works fine later ... for no clear reason :S, before breaking again, how can i debug it, where should i start ?

[joximu]

clear cache, check cookies... and update :-)

[uwe]

(03-30-2009 08:48 PM)joximu Wrote:  clear cache, check cookies... and update :-)

Well, this happens for all users, not just for me ... also we are behind a proxy, but the proxy does not cache the pages, i turned it off for this particular domain (its one domain with many sub domains) , clearing the cache and cookies does not seem to help in a consistent way . ill test it more, but it would be great if there is somewhere where i can start looking for potential problems.

[uwe]

its there , now im getting the same problem without proxy , clearing cache and cookies is not helping !!, this happens when many users try connecting concurrently!

[uwe]

Hello!

This happens users connect from a single IP (campus gateway/proxy), in the login table i get entry like:

| 071eExXpfhUszXSO,VI1fKHsH1e | 172.20.2.3 | 1266850312 | 28 | 6 | NULL|

This ip is the internal IP of the proxy server (the proxy is mandatory on all machines by policy)...

Is there a way to get around this issue ? is there a way to make ispcp accept multiple logins per IP and have them stored in seperate records ? i know this would probably not be desired for security reasons maybe, but i would like to avoid this behaviour in my case.

[uwe]

Well, i replaced

PHP Code:

//$query = "REPLACE INTO `login` (`session_id`, `ipaddr`, `lastaccess`, `login_count`, `captcha_count`) VALUES (?,?,UNIX_TIMESTAMP(),?,?)"; 


with

PHP Code:

$query = "INSERT INTO `login` (`session_id`, `ipaddr`, `lastaccess`, `login_count`, `captcha_count`) VALUES (?,?,UNIX_TIMESTAMP(),?,?)"; 


in function check_ipaddr in gui/include/login-functions.php

i assume this will "fix" the issue for me, but allowing users to keep retrying passwords by flushing coockies ? (i have disabled brute force detection anyway) !

If this will have other complications, please advise !