Log in with username/password: lyceum/lyceum

Ticket #729 (closed defect: fixed)

Opened 1 year ago

Last modified 6 months ago

Incorrect instances of timed out or missing tokens

Reported by: lyceum Assigned to: jjb
Priority: highest Milestone: 1.0.2
Keywords: tokens Cc: kwsherwood@gmail.com, flatfender@gmail.com, bryan.thale@motorola.com

Description (Last modified by jjb)

I'm having a token timeout problem, with the error message sporadically appearing when students try to post/save; test is lost. It occurs in both IE and Firefox. It seems to timeout in less than 30 minutes.

  • Lyceum 0.34
  • PHP 4.4.1
  • Mysql Ver 12.22 Distrib 4.0.27

see also: #379, #748

Attachments

post.diff (1.8 kB) - added by bthale on 04/03/07 10:45:15.
Patch to prevent token deletion prior to returning links to the user that reference the token.

Change History

01/25/07 20:31:04 changed by jjb

  • milestone set to 1.0.

Can you give a step-by-step way to reproduce the problem? thanks.

01/25/07 21:29:36 changed by lyceum

I am using lyceum in a lab situation, approximately 24 users at a time, with 75 total registered blogs. The error seems to occur sporadically ... only when a user attempts to publish or save a post. I will continue to track it but cannot presently describe a setp-by-step way to reproduce the problem.

One additional detail that may be a clue -- this work was done in a lab with modest speed connections, so that routine actions seemed to be performed at slight delay. I don't know if the token timeout could be linked with overall server load (i.e. 24 users posting, updating, changing themes etc. at once).

02/21/07 14:46:22 changed by lyceum

I experience this same problem with 7 blogs, 3 of which are active. You can login and try to immediately comment and timeout happens almost every time. Right now our blogs are very low volume.

Since lyceum user can't edit ticket, adding email address here since can't add to cc list.

flatfender@gmail.com

02/23/07 14:23:23 changed by lyceum

token timeout problem still exists in trunk from 20070223

03/04/07 02:38:15 changed by jjb

  • cc changed from kwsherwood@gmail.com to kwsherwood@gmail.com, flatfender@gmail.com.

03/04/07 02:44:48 changed by jjb

  • description changed.

Folks-

I can't reproduce this. If anyone can give me a step-by-step to reproduce, that would be very helpful.

Thanks.

03/09/07 09:16:32 changed by lyceum

Ok, so my problem with this was mis-understood, I cannot reproduce this, I was confusing this post timeout with a comment problem(which I fixed). I mis-read this issue.

Flatfender at gmail

(follow-up: ↓ 9 ) 03/13/07 17:24:24 changed by jjb

Folks-

Is anyone CCed on this ticket still experiencing this problem in trunk?

Thanks, John

(in reply to: ↑ 8 ) 03/15/07 13:18:27 changed by lyceum

I have a relatively new, relatively low-usage Lyceum install, and both I and another blog owner get the message 'Your tokens have timed out. Reload the page to reset your tokens'. It happens intermittently, so I can't reliably reproduce the error, but consistently. It happens after as soon as two or three minutes of inactivity. Sometimes refreshing the page clears the error, sometimes it takes two or three refreshes. I'm also using Lyceum .34.

03/22/07 20:59:12 changed by lyceum

Is it possible that anyone who is experiencing this problem has changed the MAINDOMAIN or WEBROOT variables in wp-config.php at any point. I had a token time out on commenting not posting and I tracked it down to having different URL's in the DB. Lyceum hard codes alot of URL's in the database. For example I originally had blogs.example.net as the main domain, but I changed it after I had some blogs setup to blog.example.net, so what might be happening is that the hostname is changing b/c of entries stored in the DB and thus the tokens do not match the URL. I'd try to see if you can see two different URL's before token time out and after. Once I fixed all the URL's in the DB, my problems went away.

flatfender at gmail

(follow-up: ↓ 12 ) 04/03/07 10:43:08 changed by bthale

I think the culprit here looks like change #789 which added a by default purge of the token whenever it is being validated. The change doesn't appear to have been propagated to wp-admin/post.php.

I've attached a patch to post.php which seems to fix the problems we've been running in to here, but I think the original change was too aggressive. Purging the token as a side effect of validation doesn't seem very intuitive and is likely prone to error. (Obviously! ;-) ) Shouldn't the default action be to retain the token with explicit action being required to purge it?

04/03/07 10:45:15 changed by bthale

  • attachment post.diff added.

Patch to prevent token deletion prior to returning links to the user that reference the token.

(in reply to: ↑ 11 ) 04/03/07 11:34:57 changed by bthale

Replying to bthale: Oops. Identified the wrong change. 789 is relaxing the purge, not adding it. Oh, well. The rest of the comment remains valid, the token purge is too aggressive. Actual problem probably started way back in 426.

04/04/07 00:19:39 changed by bthale

  • cc changed from kwsherwood@gmail.com, flatfender@gmail.com to kwsherwood@gmail.com, flatfender@gmail.com, bryan.thale@motorola.com.

08/12/07 15:21:13 changed by jjb

  • description changed.

08/12/07 18:47:52 changed by jjb

Cleaned up post.php considerably... [1055]

10/07/07 21:55:53 changed by jjb

  • owner set to jjb.
  • status changed from new to assigned.

10/07/07 22:27:14 changed by jjb

  • priority changed from high to highest.
  • milestone changed from 1.0 to 1.0.1.

Cannot reproduce, but Adam continues to experience it.

Maybe under unknown circumstances, tokens are not being generated and places into the database correctly? Should put in logging and safeguards regarding token generation and consumption, so that if a token is not generated and inserted correctly, the user will be informed and the event will be logged.

Meanwhile, we are doing a dump of all request information so the user can copy and paste their work if need be. see #772

10/20/07 23:19:05 changed by jjb

  • milestone changed from 1.0.1 to 1.1.1.

10/20/07 23:31:57 changed by jjb

  • milestone changed from 1.1.1 to 1.0.1.

Adam notes that this problem may be due to having login cookies for two users at once.

10/21/07 01:56:52 changed by jjb

And Adam discovered this due to the problem described in #857

10/21/07 02:15:52 changed by jjb

Logging token failures: [1231]

10/21/07 02:57:36 changed by jjb

  • summary changed from token timeout 0.34 to Incorrect instances of timed out or missing tokens.

10/21/07 02:58:02 changed by jjb

Resetting session when logging in and out: [1232]

10/21/07 04:00:50 changed by jjb

10/31/07 00:04:20 changed by jjb

  • milestone changed from 1.0.1 to 1.0.2.

Awaiting further data...

11/24/07 03:16:46 changed by jjb

11/24/07 03:18:10 changed by jjb

Since tokens no longer expire after being used, and stay around for a much longer time in the common case, I am going to call this closed.

11/24/07 03:22:01 changed by jjb

create #885

11/24/07 16:38:14 changed by jjb

  • status changed from assigned to closed.
  • resolution set to fixed.
Log in with username/password: lyceum/lyceum