invalid_session en dxc

Desarrollo técnico e información sobre proyectos pendientes del foro. Ayuda para problemas técnicos relacionados con la página.
Responder
Avatar de Usuario
citovel
Mensajes: 1250
Registrado: Sab 14 Dic, 2002 01:00
Ubicación: cerca de tu yugular
Contactar:

invalid_session en dxc

Mensaje por citovel » Mar 20 Dic, 2005 15:54

buenaaas:

resulta que desde que cambié la red de la oficina (hubo que pasar las ips de 192.168.x.x a 10.240.x.x en la intranet) a la hora de postear siempre me sale el mensaje

invalid_session

donde debería salir lo de "su mensaje ha sido publicado con éxito blablá".

he borrado el caché del proxy en el servidor (un proxy squid, última versión) y borrado las cookies, pero me sigue saliendo.

la conexión a internet no ha cambiado.

¿que podrá ser?
- esta máquina hará la mitad de su trabajo.
- ¡otia! ¡me llevo dos!

Avatar de Usuario
Dakewl
Mensajes: 1593
Registrado: Vie 26 Dic, 2003 01:00
Ubicación: off the shoulder of Orion ...in the dark near the Tannhauser gate
Contactar:

Mensaje por Dakewl » Mar 20 Dic, 2005 16:02

a mi me pasa a veces usando la respuesta rapida, pero dandole "pa'tras" y usando el boton Publicar Respuesta, suele funcionarme sin ese error.
Mi principal trabajo actualmente -> http://bodas.fotodual.com

SUBLIMOTRUST
Mensajes: 3248
Registrado: Sab 29 Ene, 2005 01:00
Ubicación: Microespasmos
Contactar:

Mensaje por SUBLIMOTRUST » Mar 20 Dic, 2005 16:16

A mí antes me pasaba más, ahora sólo de vez en cuando. Actualizando la página dónde escribes el mensaje se suele solucionar, o dánlo atras y actualizando. También me dí cuenta de que cuando me pasa, uno de los smiles tiene un cuandrado negro por el borde :roll: .

Avatar de Usuario
Morrissey21
Mensajes: 5095
Registrado: Lun 20 Oct, 2003 02:00
Ubicación: Vete a saber
Contactar:

Mensaje por Morrissey21 » Mar 20 Dic, 2005 16:22

A mí también me pasa a menudo, sobre todo si tengo varias pestañas abiertas con hilos de DXC. Se soluciona como bien dice SUBLIMOTRUST.

P.D Me ha pasado al publicar este mensaje xD.

Avatar de Usuario
maxgentino
Mensajes: 1184
Registrado: Sab 18 Dic, 2004 01:00
Ubicación: Buenos Aires

Mensaje por maxgentino » Mié 21 Dic, 2005 05:36

Dakewl escribió:a mi me pasa a veces usando la respuesta rapida, pero dandole "pa'tras" y usando el boton Publicar Respuesta, suele funcionarme sin ese error.
Hace más de 1 año que estoy por aquí y acabo de descubrir un botón de respuesta rápida :oops: :oops:
Firma

Avatar de Usuario
carbayonjovial
Mensajes: 743
Registrado: Dom 10 Nov, 2002 01:00

Mensaje por carbayonjovial » Mié 21 Dic, 2005 07:54

Antes me pasaba más a menudo, ahora hace tiempo que no disfruto de tal mensaje.
Cambios en el PC, pocos... Solo he puesto la 1.5 de Firefox y poco más.
Curiosamente en el curro no me pasó nunca en ninguna de las dos redes (una de 192.168.x.x y otra 10.54.x.x). Y en la segunda pasamos por proxy con filtro de contenidos.
Misterios de la informática...

jangelcm
Mensajes: 486
Registrado: Jue 16 Sep, 2004 02:00

Mensaje por jangelcm » Mié 21 Dic, 2005 22:38

Pues a mi me pasa a veces por el cortafuegos. Es posible que pueda ser problema del cortafuegos, en el caso de que lo tengas activado claro.

Un saludo :D

Avatar de Usuario
citovel
Mensajes: 1250
Registrado: Sab 14 Dic, 2002 01:00
Ubicación: cerca de tu yugular
Contactar:

Mensaje por citovel » Jue 22 Dic, 2005 00:29

perdonad que no haya contestado antes pero es que sigo sin poder y ayer apenas pasé por casa a dormir: me explico.

tengo el problema ya delimitado pues hay bastante información sobre él. resulta que la versión del foro tiene un control de IPs algo paranoico que compara las dos primeras cifras de la IP de la sesión de un usuario. es por motivos de seguridad.

cuando uno se conecta al foro se crea una sesión, una especie de ticket que es el reflejo en el servidor de la cookie en el cliente. esta sesión puede ser robada no con mucha dificultad y ser usada por alguien ajeno. por eso, ese control de sesión vigila que el lugar al que apunta mantenga más o menos constante su ip. por lo general gente que se conecta desde el mismo proveedor tiene a conservar sus dos primeras cifras iguales por un tiempo (eso si no cambian).

en mi caso la IP pegó un giro radical y por eso el foro cree que han robado mi sesión.

lo que he hecho ha sido desconectarme y he decidido esperar unos días antes de volver a conectarme, para ver si caduca.

una solución, que debería ser tomada y ejecutada por un técnico, es quitar esas pocas líneas de control. dejaría algo expuesta la página a ataques de suplantación de personalidad.

aun así, lo de invalid_session es tan común en las páginas americanas (por la política de IPs de AOL) que en centenares de sitios no han tenido más remedio que hacerlo.

por mi no hace falta si algún amable técnico de la página me informa de cuanto dura una sesión en el servidor para saber cuántos días tengo que esperar antes de loguearme de nuevo.

posteo la explicación original a continuación:
- esta máquina hará la mitad de su trabajo.
- ¡otia! ¡me llevo dos!

Avatar de Usuario
citovel
Mensajes: 1250
Registrado: Sab 14 Dic, 2002 01:00
Ubicación: cerca de tu yugular
Contactar:

Mensaje por citovel » Jue 22 Dic, 2005 00:30

phpBB uses sessions to "track" users as they move between pages, forums, topics, etc. A session is made up of a unique 32 character session_id which identifies the current users. This value is stored in the sessions table and either a temporary (i.e. it's deleted when the browser window is closed) cookie on the users machine or if that doesn't seem to be working it's appended to all URLs.

The problem with using just a session_id is that it becomes very easy to hijack (takeover) a session. All a user need do is obtain the session_id and add it to the url as they browse the board. If the id they grab happens to be a logged in admin or moderator ... well you get the picture.

What we do to help complicate the situation is also tie the session to the users IP. Using this method someone would need to spoof an IP and obtain the session_id in order to hijack a session, not incredibly difficult but certainly harder ... and with this sort of software it's really a case of making everything harder to do, thus disuading all but the most ardent "hackers" from bothering to attempt anything.

How do we obtain this IP? We check the availability of two variables, REMOTE_ADDR and HTTP_X_FORWARDED_FOR. Firstly we check for HTTP_X_ ..., this is typically set by "nice" proxies, caches, etc. and contains "an" IP which may be the users "real" IP or some other IP. If that does not exist or it contains a private or restricted IP range (several blocks of IPs are reserved by the international bodies responsible for IP allocation) we instead use the value contained in REMOTE_ADDR. This variable typically contains the users real IP.

However, problems arise with how some ISPs operate their systems. Instead of forwarding the users real IP or indeed a different but static IP they simply make available only the IP of the proxy being browsed. The larger ISPs do not use a single proxy or cache, the load upon it and data passing through it would be far too great. Instead they use several systems in a "proxy farm" (I tend to refer to it as something containing most of those letters ... ). A user browsing the web may be switched between these machines from one page to another (to help distribute load), with the IP changing as they go.

Obviously a problem then exists in that phpBB's ability to tie a users session to a unique id and an IP fails ... because the IP is constantly changing. There are some "nice" ISPs out there that run these farms within a single "class" or block of IPs, e.g. 1.2.3.4, 1.2.3.5, 1.2.3.6, etc.

This is why in a previous release of phpBB we introduced a slightly reduced IP checking system which now checks only the first three "quads" of an IP, i.e. 1.2.3.4 is checked only for 1.2.3 the 4 is discarded. Remember, that an IPv4 address is 32bits wide, this is generally presented in the form of four 8 bit numbers. By checking just the first three numbers (24bits) we neglect 8 bits or 255 (253 in practice) possible IPs ... that's 253 seperate potential proxies ... IOW enough machines for practically any ISP on the planet. However we can go further and reduce that checking to just the first "two quads", that ignores 255 * 253 IPs!

The problem is some ISPs don't arrange their IP allocation particularly well, either for historical or other reasons ... AOL is one significant culprit. So what happens is that users can jump between completely different Class A (this is a full 32bit block of IPs) networks, e.g. 100.100.100.100 to 200.100.40.40, etc. This renders IP validation completely useless for such situations

So you ask, "Okay, but why did 2.0.3 not cause all these Invalid_session errors?!". The answer is fairly simple. When you first visit phpBB (assuming you have autologin enabled) it looks to see if you have a session_id (either in a cookie or the URL). On a new visit you won't have such a session_id and so phpBB creates a new one. If you have autologin set it checks the relevant data and if that matches you are logged in with the appropriate user_id. You can then immediately browse the board, post messages, do admin tasks (if applicable), etc.

Now let's take a situation where a naughty person creates a bogus form on their site. You are (for some reason) browsing this form. However, unknown to you this form contains all the necessary data to delete a pile of topics in a given forum (you having moderator rights on a certain board). When you submit that form it will be transmitted to the appropriate website. No session exists so phpBB, as noted above creates a new one and immediately processes the form data ... all the relevant topics are deleted from the database and you only find out when the boards "The selected topics have been deleted" message appears ...

To help negate the effectiveness of this we backported some code from phpBB 2.2 and introduced additional code. The admin control panel now appends your session_id to every url. When you browse within that panel it checks the session_id in the url with that stored in the sessions table. If they match, great, if they don't it redirects you back to the ACP index. This will help prevent users accidently, without their knowledge suffering issues as noted above.

Similarly the Moderator control panel has the session_id appended to urls and carries out a check. The difference here is that it throws up an Invalid session if the ids do not match, note that redirection like the admin panel wouldn't alter the result here ... if you tried submitting data via the MCP with an invalid session you'd just be returned to MCP front page ... losing any data entered previously. Other issues with voting and posting were also addressed thanks to a concerned user notifying us. Thus similar checks were put in place there.

The problem is that for users whose session is forever being renewed due to their IP changing this extra level of checking can cause issues. For many ISPs the noted changing of 6 to 4 in the IP validation check will be sufficient ... however AOL crops up (as per usual in nearly all similar situations with all software ...) as the sore thumb.

"What can you do about it?" you may ask, very little is the response. We could remove the extra validation but that leaves a gap that frankly I'm not prepared to leave ... if hadn't addressed this I would make a handsome bet that at some near future point we would've had users shouting and screaming about how damage was done to their boards and why didn't we (phpBB) fix it if we knew about it

What else can we do? As I said, very little that won't impact users completely unaffected by this issue (of which I'm betting there are a great many) ... in phpBB 2.2 we are introducing a feature to set the level of IP validation by the ACP, including disabling it completely. However disabling IP validation will, as noted leave your users open to simplified hijacking. For many people this may not be a problem and thus could be a solution. To do this in phpBB 2.0 you need to either remove the validation code from sessions.php or change the 6 to a 0 (the relevant lines are as noted in this topic). Be aware of what you are doing though and keep quiet about it ... if people don't know IP validation isn't operational they may believe it still is. If you have security issues you can trace to users sessions being hijacked we don't want to know about it

We could introduce a change to sessions whereby what happens when a new session is created is "weakened". What do I mean by weakened? Well, at present we generate a new session whenever we cannot validate an existing one. Instead what we could do is compare the users current session_id (if they have one) with that in the database. If a match is found and the time differential is some "small" number we instead continue that session. The problem here is that it's just as open to hijacking as removing IP validation. Why? Because that check will ignore the users IP and care only about the session_id ... and thus isn't something I'm keen on without direct admin control.

We could, as per a new Mod listed elsewhere on the board, ignore IP validation whenever the users IP is within a given list. While this isn't as bad as removing validation completely it's not terribly far off. Why? Because instead of having to go to some trouble to obtain a users current IP you can instead (given you know a user connects via a given ISP or proxy) just look it up ... you still need to spoof it but a step has been removed ... and as noted previously all we can do is make these peoples lives harder. There are additional issues with the extra processing required (which may or may not be significant depending on the number of IPs, users browsing, etc.) and of keeping the list up to date.

We could append a random set of alphanumerics to every single page, changing the value of it with every page view and storing the new data in the sessions table. This would add protection because a hijacker would need not only the session_id but also the current unique identifier. Of all the ideas this is probably my favourite and may make it into a future release (unless I've missed something obvious which renders it useless or bad for performance!).

"Okay, fine but what can we do about it now?!" I hear you say. Well, you can remove or reduce validation as noted above (being aware of what you are doing), you could add the Mod noted above (you'll find it presently in another Invalid session topic ... no doubt it will be moved to one of the Mod forums in time) or finally you could remove the piece of code (from all affected pages) that looks like or similar to this:

Código: Seleccionar todo

// session id check
if ($sid == '' || $sid != $userdata['session_id'])
{
   message_die(GENERAL_ERROR, 'Invalid_session');
}

This removes the added security of validation so if you do this we aren't interested in any security related problems that may arise. I highly recommend that you do not remove the added security from the admin control panel.

There, that just about covers it I think ...
_________________
Regards

Chris Karakas
www.karakas-online.de

Last edited by chris on Sat Aug 02, 2003 8:45 pm; edited 2 times in total
Back to top
View user's profile Send private message Send e-mail Visit poster's website
chris
Dark Lord of the Sith


Joined: 10 May 2003
Posts: 4877
Location: Outer Space

PostPosted: Wed Jul 23, 2003 12:25 pm Post subject: Reply with quote
Let's clarify a little the modifications that are referred to in the above excellent posting:

You can either edit line 294 in the includes/session.php:

Código: Seleccionar todo

         $ip_check_s = substr($userdata['session_ip'], 0, 6);
         $ip_check_u = substr($user_ip, 0, 6);

and change the 6 to a 4, or, as a last resort (not endorsed by the phpBB staff and quite unsafe for the above reasons), you can delete all occurences of the code

Código: Seleccionar todo

   // session id check
   if ($sid == '' || $sid != $userdata['session_id'])
   {
      message_die(GENERAL_ERROR, 'Invalid_session');
   }

in all files. There are 9 occurences in 6 files:

Código: Seleccionar todo

includes/usercp_email.php
includes/usercp_sendpasswd.php
modules/Forums/groupcp.php
modules/Forums/login.php
modules/Forums/modcp.php
modules/Forums/posting.php on line 188

But most of the time, just changing the cookie, as described in the first posting, will solve the "invalid session" problem.
- esta máquina hará la mitad de su trabajo.
- ¡otia! ¡me llevo dos!

Responder