Just now when I tried to log in, after typing my login credentials, it failed to log me in, Tried that several times, but same result.
Finally I decided to Shift F5 then it automatically logged me in, without me inputting my log credentials again.
let us know if that happens again, might have had something to do with the auth related code that was pushed in the past 24 hours / cache etc.
I have the same Problem. I logged in Yesterday and let the Browser open, then this morning i had to relogin, so i clicked on Login ...:
Request
POST /login HTTP/1.1
Host: community.nodebb.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:34.0) Gecko/20100101 Firefox/34.0
Accept: /
Accept-Language: de-de,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
x-csrf-token: JeYKg0SP-ogi0oId5I25LmkFrIuFH6GAiJho
X-Requested-With: XMLHttpRequest
Referer: https://community.nodebb.org/login
Content-Length: 73
Cookie: express.sid=s%3AJbfGk0kTbgSsJRCOsYYRPCbqpj1om1Vq.4leOFMahMtak8WYv5j4WwwP779LhpsjenK%2Bnbskz6T8
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Parameters
username=Nifty&password=xxxx&remember=on&returnTo=search%2Fno%2520login
Response
HTTP/1.1 403 Forbidden
Server: nginx/1.4.6 (Ubuntu)
Date: Sun, 14 Dec 2014 07:56:47 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 9
Connection: keep-alive
x-powered-by: NodeBB
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Body
Forbidden
I had to reload the Page (F5) to get into.
@psychobunny Many of my users are unable to log in because of this. Sometimes it works on the second or third try, but a few have reported it's impossible to log in.
There is a fix we committed to master that might solve the login/register csrf issues. Although it only happened if your site title had an apostrophe in it.
@julian Interesting. My site title does not, but my site description does, along with commas in the site keywords. I'm on the 6.x branch currently.
I suppose I could jump to master and then wait until 6.x is fixed?
@julian Looks like they were actually able to log in, but the 'Find Category' option that was added was automatically disabled for everyone except the Admin, thus they were logged in but couldn't see anything. False alarm, I think.
@julian There is no apostroph on my side.
