Invalid request token

[stevecureboi]

Forum URL: thecurecommunity.freeforums.net/forum
I have seen the other thread on this (which came back to life around the same time my issue began)  but I guess I need to start a new one as per usual rules.
I have a newly registered member (waves1970) who is getting the invalid token request message when trying to log in to his approved account.
Message reads
Invalid request token/ possible request forgery (error 1). If you received this message in error, please go back, refresh and try again.

This was yesterday night. I came straight here to see if there was a general problem & nothing had been flagged at the point. So I searched the topic & advised him to do exactly what had been suggested to fix it. (Cache clearing, cookie deletion etc.)
No dice.
He even tried on different browsers to no avail. Eventually it got pretty late so I told him I'd have a look this morning. So here I am.
I cannot find anything untoward with his account & nothing in the security logs indicate he was banned or deactivated.
The trail goes cold there & I still have a guy who cannot log in to his new account.
Is there any chance someone could look at this please.
If need be, I can fwd IP addy etc via PM to one of the staff here if it helps.

Thank you

steve

[jessitap]

When that happens, it has nothing to do with if their account is banned, deactivated, etc. Looking into the status of the account would not help in this situation. It's only caused by browser issue.

Essentially they're doing something for Proboards to be confused about what account they're trying to post as or access. 

I know you said they cleared their cache already, but do they have multiple global accounts? (Aka accounts on Proboards with different emails.)  That has caused this for me before. Or even multiple accounts with the same email on your forum?

Also alternatively, they can log in to their Proboards Dashboard and click on their username on your forum (it's a list of all the forums they belong to and all the accounts they have). It'll instantly log them in and bring them to your page without issue.

[stevecureboi]

Thanks jessitap but they don't have any other PB forum accounts other than the one they set up at TheCureCommunity.

[Scott]

stevecureboi - what jessitap stated is correct though. It is a browser/cookie issue.

Have the user try to access the forum in an incognito/private window and see if that makes a difference.

[stevecureboi]

Nov 6, 2022 7:54:12 GMT -8 Scott said:

stevecureboi - what jessitap stated is correct though. It is a browser/cookie issue.

Have the user try to access the forum in an incognito/private window and see if that makes a difference.

Incognito worked (chrome browser). Don't know why there was a problem though. I almost got them to re-register I was so stumped

[Kami]

Nov 6, 2022 8:10:57 GMT -8 stevecureboi said:

Nov 6, 2022 7:54:12 GMT -8 Scott said:

stevecureboi - what jessitap stated is correct though. It is a browser/cookie issue.

Have the user try to access the forum in an incognito/private window and see if that makes a difference.

Incognito worked (chrome browser). Don't know why there was a problem though. I almost got them to re-register I was so stumped

So, the "forgery" error effectively pops up when the login cookie set by the forum that is stored in the browser becomes corrupted. While you may not see this error on other sites, it does manifest in other ways (for example, some companies forcibly log you out of their platform to reset the login cookie).

Several things can cause this (not a complete list, but a few reasons are: mismatch on the date/time between the forum and the computer, multiple sessions on the same device including having multiple tabs open when the user is taking different actions in each tab, multiple accounts).

While clearing the cookies and cache should work (clearing cookies should remove the corrupt one, clearing cache removes any stored page loads), depending on the user's settings their clearing might not go far enough — Chrome, as a for instance, allows 3 different stages of clearing (last week / month / all time, or something to that effect). If a user doesn't use the "all" clear, which would clear everything since the beginning of the browser's history of us (or since the last time this option was selected), there is a chance that they may not actually clear the corrupted cookie depending on when that cookie was initially set. Alternatively, the settings on clearing saved data may not have included all the cache and cookies from all sites — mine is personally set to only clear cache but never cookies as a for instance, and only for certain pages unless I manually change that.

Incognito loads web pages without cookies or cache — there's no personal data attached to an incognito session, and nothing is stored once the session is terminated. This is why loading a website you're having issues with in incognito should generally be the first port of call. If the issue is resolved via incognito, that immediately points to an issue with stored data in the browser.

Hope this helps!

[stevecureboi]

No. It doesn't really.
Multiple browsers and multiple cookie deletions didn't work.
Does this mean he has to use incognito mode every time?
Seems a bit odd to me.

[Michael]

Nov 7, 2022 15:15:55 GMT -8 stevecureboi said:

No. It doesn't really.
Multiple browsers and multiple cookie deletions didn't work.
Does this mean he has to use incognito mode every time?
Seems a bit odd to me.

This sounds like the cookie isn't being deleted. Make sure they're clearing ALL cookies, not just recent cookies.

You won't see this error without a cookie being set first.

[Kami]

Nov 7, 2022 15:15:55 GMT -8 stevecureboi said:

No. It doesn't really.
Multiple browsers and multiple cookie deletions didn't work.
Does this mean he has to use incognito mode every time?
Seems a bit odd to me.

Nov 7, 2022 15:20:09 GMT -8 Michael said:

Nov 7, 2022 15:15:55 GMT -8 stevecureboi said:

No. It doesn't really.
Multiple browsers and multiple cookie deletions didn't work.
Does this mean he has to use incognito mode every time?
Seems a bit odd to me.

This sounds like the cookie isn't being deleted. Make sure they're clearing ALL cookies, not just recent cookies.

You won't see this error without a cookie being set first.

In addition to what Michael was saying above, it also depends on how the user was attempting to delete cookies.



Chrome offers several options when deleting any saved data; assuming that the user properly selected "cookies and site data" + cache, then the next thing to check is the dropdown in the image above.  By default (in other words, if the user does nothing else), the time range is last hour. An easy way to check whether or not the cookie was in fact deleted would be to search for the site itself.

If they go to their chrome settings under Privacy and security > cookies and other site data, there's an option towards the bottom that reads "See all site data and permissions". Have them click on this, and type in 'proboards.com' in the search bar at the top right of the page. It should come up with a list of all PB forums they've visited & have saved data for. They should check to see if your forum is listed here, and if so, to click on it specifically and delete the cookies associated with it (I would recommend walking them through this via screenshare or by sending you screenshots to make sure that things look correct.

Here is an example of what it should look like, using my cookies for PB Support:





Broadly speaking, switching to a browser they've never used before should solve the issue in much the same way that loading an incognito browser would; however, that's reliant on them not ever having used that browser before to access the site. If at any point they used a browser to access the site whilst logged in, this could cause this method not to work (which is why incognito is more reliable).

Honestly, I usually solve this problem by simply closing out all duplicate tabs and pressing CTRL + F5 a few times on my keyboard while on the site in a single tab, and then attempting to log in again.