Thread

Dear EL management,

We just lost a customer, who asked for a refund, due to inability to login; we are experiencing a pattern of increased login problems after upgrading to EE 2.X.

Our excellent-beyond-words developer Shawn is following a relevant thread https://support.ellislab.com/bugs/detail/17423
... but i am concerned, is nobody assigned, is this bug really 40+ days outstanding?

I just hope that you are PRIORITIZING bugs: most bugs are “business as usual” and do not cause a big problem. No worries, EE has been pretty great on balance.

But when paying customers can’t login to our site, it threatens our business and our reputation. I would be really relieved to hear that your process floats mission critical bugs/issues (e.g., log-in to the CMS) to the top of the stack.

(SORRY to post here, you can move it, i can’t seem to post in the Technical support forum and i am short on time. You guys are great, thanks for having a forum to hear feedback!)

David Harper
.(JavaScript must be enabled to view this email address)
http://www.bionicturtle.com

Hi David,

I hate to hear that you’ve lost a customer over this. Believe me, I understand this bug is a big one for you. It’s a big one for a lot of folks, ourselves included. In general, we do have a mechanism for making sure bugs that are really critical for our users float to the top by having those users who are reporting bugs mark them as show-stoppers. You can see that this bug is marked as one, but in addition, I’ll let you know that this particular bug has our full attention right now. It’s the biggest one we want to knock out. I really mean that, too. I suppose we haven’t actually assigned it to any single developer yet because we’ve actually got several of them working on a fix for it. Two of them have posted comments in the bug report today, in fact. (Wes and Pascal.) It’s just taking a while to fix because it’s actually a rather complicated bug that likely has several contributing factors. We’ve already knocked out one of the big potential causes with the release of 2.4.0, and the bug report you mentioned is meant to help our devs figure out what else might be causing the issues. They’re hard at work trying to fix it, I promise.

Now with that said, if your user was having trouble logging in in the first place, this bug wouldn’t be the place to look for a solution. There are some other things our Customer Advocates can suggest to help troubleshoot those issues. Would that be something worth investigating with our team or is it, unfortunately, now a moot point?

I’ve moved this thread to the EE 2 Tech Support forum and made sure your account has the ability to post there. I’ll personally stay subscribed to this thread and make sure you get the help you need here if that’s something you’d like to do. Just let me know. I’m here to help.

Hi Kevin,

THANK YOU for responding, it is really great to hear that it is a priority! And I can imagine that it’s a complicated issue

Thanks also for offer of follow-up Customer Advocate support. It is possible (or even likely) this bug is our only real log-in issue (I’m not in a good position to say; it’s hard sometimes to parse platform from user issues), in which case further help would be moot ... I posted to Shawn to see if he wants/needs further support, in which case he may follow-up. Thanks again!

Hi Kevin,

Assuming I’m looking at this correctly users are actually being logged in to EE.  I believe the issue is that user’s IP addresses change on every single request which makes it seem as though they are not able to log in.

I think this is one of the relevant bug reports:
https://support.ellislab.com/bugs/detail/17423

On David’s site the particular customers experiencing issues have IP addresses that are changing on every page load (actually every file request).  Instead of being logged out after a few minutes as is typical in the bug reports these users are essentially logged out instantly.

Sincerely,
-Shawn

Hi Shawn,

Yes, if the IP address is changing on every request, that’s definitely going to log them out. For reference so that I can help inform the developers, do you know why the network is set up that way? I know that EE’s ability to hold sessions is contingent upon a user maintaining the same IP address as a matter of security, but obviously that’s not going to work in all cases. It would be helpful to know how many other users of EE might be facing the same issues.

I see from the bug report that you’ve implemented the change that Wes recommended. Have you also done the same for the one Pascal recommended? It seems that’s one more spot that our system checks for IP address, so if we can circumvent that in your system, that might alleviate the issue for you.

I know these aren’t long-term solutions, but finding out what works for users in the short-term will help inform the developers as they come up with a solution that’ll work for everyone in the long-term.

Hi Kevin,

These users appear to be consistently on ISPs in either India or Singapore.  The bug post I linked to also noted users from Singapore which is why I suspect it’s the same issue.

"Notes: I’m from Singapore, it seems to affect certain ISP more than others. On Starhub(ISP) my session can last till 1-2hours while on Singnet(ISP) the CP logs me out every 10-20seconds."

I did apply Wes’ fix but have not applied Pascal’s.  The issue affects a small percentage of David’s 20k+ registered members so I’m hesitant to implement security related hacks in the core unless EllisLab is relatively confident that we are not opening unnecessary holes in the site by doing so.

Also note that we did not receive any reports of this issue until we upgraded to 2.4.0 from 2.2.2 early last week.

Thanks for your help.

-Shawn

That’s certainly a reasonable route to take, erring on the side of caution with such a high member site.

Along the same lines, you might not be comfortable doing this, but you’ll see in the bug report that Kevin Cupp, another one of our developers, just posted a diagnostic tool that will help us get more information from users on systems that are seeing frequent logouts.

I’ll note, too, that Signapore does come up a lot in the logout discussions, and it sounds like that’s because ISPs in Singapore apparently change the user’s IP address quite frequently. Obviously we can’t have a sessions system that precludes sessions coming from an entire country, so we’ll get this cracked.

Hi Kevin,

Thanks for the continued quick responses.  I really appreciate the help. 

I just emailed Kevin to confirm that the diagnostic tool is also for non CP related logout issues.  I’m more than happy to help get to the bottom of this and installing Kevin’s code is the least I can do.

-Shawn

Awesome, glad to hear you’ll help us test! I’m going to go ahead and close this thread up since it looks like we’re making some good progress with that bug report. If you need anything else, feel free to update the bug report, email Kevin Cupp, or email us at .(JavaScript must be enabled to view this email address), whichever is appropriate.