<![CDATA[PunBB Forums — Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/topic/20572/unable-to-confirm-security-token-can-i-increase-the-time/ Tue, 10 Feb 2009 11:31:29 +0000 PunBB <![CDATA[Re: Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/post/124392/#p124392 1. What is the PHP version running forum?
2. Server TZ setting?
3. Your local TZ?

]]> Tue, 10 Feb 2009 11:31:29 +0000 https://punbb.informer.com/forums/post/124392/#p124392 <![CDATA[Re: Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/post/124381/#p124381 it is very very very common that I get the security message. I don't think my users get it. someone suggested it mainly affects admins

]]> Tue, 10 Feb 2009 08:02:10 +0000 https://punbb.informer.com/forums/post/124381/#p124381 <![CDATA[Re: Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/post/124373/#p124373 esupergood wrote:

So the online timeout should be around 3 minute (for my site) and the security token should be a separate value.

As it was stated above, token is stored in online table. So that when user goes offline, the token is lost.
You may modify the code or make an extension to implement the logic you need, e.g. store the csrf token in users table...
Nevertheless, it seems to me very seldom, when you cannot find the balance between "long writing" and "quick online status update".

]]> Tue, 10 Feb 2009 06:34:59 +0000 https://punbb.informer.com/forums/post/124373/#p124373 <![CDATA[Re: Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/post/124365/#p124365 esupergood wrote:

posters who make topics like "hello username"

...should be banned tongue

]]> Mon, 09 Feb 2009 20:31:21 +0000 https://punbb.informer.com/forums/post/124365/#p124365 <![CDATA[Re: Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/post/124356/#p124356 slavok wrote:

To increase time frame of the security token, you should increase the online timeout. You can do it on "admin/settings.php" page in the "Default timeouts and redirect delay" section.

This is not a good solution I'm afraid.
If a user spends 5 minutes composing a new post (this is very common on my forum) then he should be hit with the security token measure. This is just putting people off using the forum. Also, I don't want people to remain in the online list for 5 minutes after they leave the site. This results in confusion amongst posters who make topics like "hello username" when in fact the person they are talking to left the site 4 minutes ago.

So the online timeout should be around 3 minute (for my site) and the security token should be a separate value.


That is just my opinion anyway

]]> Mon, 09 Feb 2009 18:35:19 +0000 https://punbb.informer.com/forums/post/124356/#p124356 <![CDATA[Re: Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/post/124214/#p124214 We have the url of a requested page and csrf_token in the table online (it is generated when user log in). These two strings are concatenated and hashed with sha1-algorithm. Given value is stored on the forum page in a hidden value.
There is an option "Online timeout". It defines the count of seconds idle before a user is removed from the online users list.
Every time a user requests a page of the forum, the list of online users is updated. This means that some information about the current user (logged time and previous url) will be updated, and all users, logged more than online timeout seconds ago, will be removed from the online table.
When a visitor writes his post more than online timeout and other users are browsing forum pages, the posting user will be removed from the online list. When a user presses the "Submit" button, he will be authorized via a cookie and, as he was removed from online table, a new csrf_token will be generated in the online table. So csrf_token in the online table doesn't equal csrf, which was used to generate csfr-token at the requested page.
To increase time frame of the security token, you should increase the online timeout. You can do it on "admin/settings.php" page in the "Default timeouts and redirect delay" section.

]]> Fri, 06 Feb 2009 19:10:20 +0000 https://punbb.informer.com/forums/post/124214/#p124214 <![CDATA[Re: Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/post/121552/#p121552 This bug is really annoying. I've tried to find the cause some times, but I've found nothing sad
There is to much code verifying user's cookies and security tokens.

I've supposed that the bug appears on posting a form when somebody else have visited the forum after a forum page with the form was opened in browser. Also I thought this error is shown only for admins. Am I right?

We'll continue the investigation smile

]]> Wed, 24 Dec 2008 13:55:07 +0000 https://punbb.informer.com/forums/post/121552/#p121552 <![CDATA[Re: Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/post/121541/#p121541 I'm personally rather unfamiliar with the specifics of the 1.3* code, but I'm sure one of the devs should be able to point you in the right direction. You have to allow time for the fact that it is Christmas, when factoring for a response, however. smile

]]> Wed, 24 Dec 2008 10:25:34 +0000 https://punbb.informer.com/forums/post/121541/#p121541 <![CDATA[Re: Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/post/121538/#p121538 MattF wrote:

That's defeating the purpose of having the security token, however.

But the way it was causing problems. Users were frustrated. The time length needs extending. Is there a description somewhere that I can read stating why the time is so short?

]]> Wed, 24 Dec 2008 09:07:07 +0000 https://punbb.informer.com/forums/post/121538/#p121538 <![CDATA[Re: Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/post/121533/#p121533 You're right, I'll edit my post saying it's decreasing their security in bold letters so users know.

]]> Tue, 23 Dec 2008 23:56:59 +0000 https://punbb.informer.com/forums/post/121533/#p121533 <![CDATA[Re: Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/post/121532/#p121532 Garciat wrote:

Yeah, of course.

It is not a good idea to suggest to people an option which is decreasing their security.

]]> Tue, 23 Dec 2008 22:33:50 +0000 https://punbb.informer.com/forums/post/121532/#p121532 <![CDATA[Re: Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/post/121524/#p121524 Yeah, of course.

]]> Tue, 23 Dec 2008 20:09:54 +0000 https://punbb.informer.com/forums/post/121524/#p121524 <![CDATA[Re: Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/post/121521/#p121521 That's defeating the purpose of having the security token, however.

]]> Tue, 23 Dec 2008 16:53:14 +0000 https://punbb.informer.com/forums/post/121521/#p121521 <![CDATA[Re: Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/post/121514/#p121514 The end would be ok, I guess.

]]> Tue, 23 Dec 2008 13:44:16 +0000 https://punbb.informer.com/forums/post/121514/#p121514 <![CDATA[Re: Unable to confirm security token (can I increase the time?)]]> https://punbb.informer.com/forums/post/121512/#p121512 Anywhere in particular?

]]> Tue, 23 Dec 2008 13:01:39 +0000 https://punbb.informer.com/forums/post/121512/#p121512