SOLVED session mismatch error after deleting user


  • Hi guys,

    I need to get out of a trouble I really can't figure out how to.

    This morning in order to get my forum cleaned up for an internal testing phase, I have deleted all the users (and their posts) from via the administration panel. Everything went well and the forum got cleaned up except for the admin account.

    I'm now trying to re-register myself with my previous credentials I used as standard user but after the initial success of the registration I've nodebb constantly showing up this "Session Mismatch" pop-up.
    281092fd-b0a5-48fe-842b-e99d47075d73-image.png
    I've trie with cleaning the browser cache, I've tried with a different browser, I've tried to clean-up also the sessions collections in the Mongo DB but I still get the pop-up.

    Do you have an idea how I can get it fixed? Or the sole option I have is to restore the database before the users clean-up phase?

    Thanks, Riccardo


  • @baris thanks a lot! You brought me into the right direction.

    I've queried the DB for db.getCollection('objects').find({"_key":{$regex:'maxonIDId:uid'}}) and deleted the found object. This just made the trick and disconnected the retuned OAuthID from the actual nodebb uid.

    Thanks a lot for looking at the thread and also checking the my code!

    Really appreciated you're awesome guys!

  • NodeBB

    Does it work after you execute app.logout() in your browser console?

  • NodeBB


  • @baris said in session mismatch error after deleting user:

    app.logout()

    Thanks @baris running app.logout() just stops the pop-up to show up cause an actual logout takes place, but as soon as I attempt to login the pop-up starts again and again

  • NodeBB

    What is your config.json? Are sessions stored in mongodb or redis?


  • @baris

    config.json looks like

    {
        "url": "https://aaa.bbb.ccc.ddd",
        "secret": "xxxxxxxxxxxxxxxxxxxxxxx",
        "database": "mongo",
        "mongo": {
            "uri": "mongodb://nodebb:nodebb-pass@localhost/nodebb",
    	    "uri_long": "mongodb://nodebb:nodebb-pass@localhost/nodebb"
        },
        "port": "4567",
        "socket.io": {
            "origins": "https://aaa.bbb.ccc.ddd:*"
        },
    

    and looking in the DB I see in the sessions collections

    /* 1 */
    {
        "_id" : "bzuVRBphBzKSUZ3Yt9VxEQUPuJoU5nKh",
        "expires" : ISODate("2021-03-05T15:41:25.409Z"),
        "session" : "{\"cookie\":{\"originalMaxAge\":1209600000,\"expires\":\"2021-03-05T15:41:17.902Z\",\"secure\":true,\"httpOnly\":true,\"path\":\"/\",\"sameSite\":\"Lax\"},\"returnTo\":\"/\",\"flash\":{},\"passport\":{\"user\":8}}"
    }
    
    /* 2 */
    {
        "_id" : "mqBJSla7h9jDaRjbdpEsCpbIaXpZxKIX",
        "expires" : ISODate("2021-03-05T17:02:35.259Z"),
        "session" : "{\"cookie\":{\"originalMaxAge\":1209600000,\"expires\":\"2021-03-05T17:02:34.250Z\",\"secure\":true,\"httpOnly\":true,\"path\":\"/\",\"sameSite\":\"Lax\"},\"returnTo\":\"/\",\"flash\":{},\"registration\":{\"returnTo\":\"/\",\"uid\":8},\"passport\":{\"user\":8}}"
    }
    

    I've tried already to delete anything in the sessions collection but with no better luck

    To give better context consider that my user is attempting to authenticate using this OAuth2 plugin I've developed and nodebb get stuck as soon as I'm authenticated against my identity provider and I'm going to set my privacy settings
    6803b2c6-898b-406f-90a6-56de201624b5-image.png

    Thanks for any help


  • Global Moderator

    Can you try a different browser or a private browser?


  • @pitaj already done and sadly no better results


  • Looking at one of the sessions object I've spotted
    "registration\":{\"returnTo\":\"/\",\"uid\":8},\"passport\":{\"user\":8}}"

    which seems like it's referring to the same uid that my user had before getting deleted. Looks like that re-registering myself with the same account tries to use the same uid.

    Does it make any sense to you gurus?

    Cheers, R

  • NodeBB

    What are the contents of this object constants.name + 'Id:uid' where they deleted when all users were deleted?


  • This post is deleted!

  • @baris thanks a lot! You brought me into the right direction.

    I've queried the DB for db.getCollection('objects').find({"_key":{$regex:'maxonIDId:uid'}}) and deleted the found object. This just made the trick and disconnected the retuned OAuthID from the actual nodebb uid.

    Thanks a lot for looking at the thread and also checking the my code!

    Really appreciated you're awesome guys!

  • NodeBB

    That sounds good!, I think you should check your plugin and make sure the ids are deleted from that object, it seems like this code should do it not sure why it wasn't cleared when you deleted all users.

Suggested Topics

| |