Doing some further login/cookie investigation, discovered a few AJAX files that weren't setting the session and yet the were pulling in the user class resulting in the cookie being regenerated when the user class detects no session and then starts it. Going to fix those and then carry on investigating, it's entirely possibly they were one part of the issue since they were messing with the session when not needed. Keep your fingers crossed.

*fingers crossed*^_^

Right, the fixes are up. Do let me know if you continue to see logouts.

1 hour ago i was logged in, now i was logged out again. But maybe that was legacy, we'll see tomorrow for sure xD

Quoting: Termy1 hour ago i was logged in, now i was logged out again. But maybe that was legacy, we'll see tomorrow for sure xD

I am curious to know if you manage to figure out anything in particular that does it. Would like to narrow it down now the above issues are solved.

So i was just logged out again - i took a look at the cookies this morning and noticed that gol-device and gol_session were not there despite still being logged in?!
I've now saved the cookies and next time i'm logged out i will try loading them again and see if they get deleted again.

Quoting: Liam Dawe

Quoting: Termy1 hour ago i was logged in, now i was logged out again. But maybe that was legacy, we'll see tomorrow for sure xD

I am curious to know if you manage to figure out anything in particular that does it. Would like to narrow it down now the above issues are solved.

Ok, it seems that the site really is deleting gol-device and gol_session after a time. I was just logged out, the cookies were gone. I recovered the backup, reload the site - cookies deleted.

I would assume that the hash stored in this cookies is also stored somewhere on the server and deleted if they don't match or something like that?

Edit: i just tried editing the values of those two cookies - no logout. But as soon as i also edited the value of the PHPSESSID cookie, i was logged out and the other two cookies were deleted.
I then tried to only modify PHPSESSID, but that didn't log me out or delete the cookies.

So it seems all three cookies have to mismatch? I'm no Webdev, but maybe you can make something of this? ^^

Last edited by Termy on 28 November 2019 at 8:35 am UTC

Messing with the cookies won't do much, until your session expires and they're read again.

Still tracking where it happens, but since my fixes posted earlier it's not happened once to me personally when I saw it often. So it must be something you're doing, that I'm not where it happens.

Quoting: Liam DaweMessing with the cookies won't do much, until your session expires and they're read again.

Still tracking where it happens, but since my fixes posted earlier it's not happened once to me personally when I saw it often. So it must be something you're doing, that I'm not where it happens.

Well, it does do something: make the site delete the cookies ;)
If i modify the value of all three cookies (just changed the last digit) and then visit the site, gol-device and gol_session get deleted despite expiry set to 27-01-2020 and i'm no longer logged in.

Quoting: Termy

Quoting: Liam DaweMessing with the cookies won't do much, until your session expires and they're read again.

Still tracking where it happens, but since my fixes posted earlier it's not happened once to me personally when I saw it often. So it must be something you're doing, that I'm not where it happens.

Well, it does do something: make the site delete the cookies ;)
If i modify the value of all three cookies (just changed the last digit) and then visit the site, gol-device and gol_session get deleted despite expiry set to 27-01-2020 and i'm no longer logged in.

Yes, if you modify the gol_session cookie, the next time it is read when your session expires it will kick you out. It's supposed to do that ;)