Doctor Skids
Champion Penguin Thrower
Age: 35
Joined: 20 Sep 2005
Posts: 1907
Location: Begging For Pocket Lint
|
 Posted: Wed Mar 28, 2007 7:23 am Post subject: |
|
|
|
Here's the technical reasoning behind why some users get invalid sessions:
phpBB2 uses sessions to keep track of users as they browse the board. These sessions use a combination of a unique session id and the users IP to identify each user. We make use of the IP as an extra safe-guard to help prevent sessions being hijacked (by discovering the unique session id).
Unfortunately this only works when the users IP is constant as they browse the board. For most users this will be the case. However certain providers route their users via a cluster of proxys. In some cases, particularly AOL this results in different IPs being forwarded as the user moves between pages. We take account of this by not checking the entire IP but only the first "three quads". Again in most cases this will be fine. However again AOL uses IPs which can vary so much that checking only the first two quads results in a fairly static IP being available for session validation.
If you are experiencing problems related to this you can make a small change to the code. Please note that reducing the IP validation length does potentially increase the risk of sessions being hijacked (this is something for you to consider, phpBB Group takes no responsibility should anything happen!). The change requires you to...
So it's okay that you have AOL... just login through AOL, but then instead of browsing with the AOL browser, get into the habit of using the IE browser that comes with your system or just use another like Firefox.
It's the AOL browser that is touchy, not the service... of course.
You may have read here that Firefox seen ads for it. It's because it is a good browser and is more secure than most. I recommend it highly, but if you don't want to install it, just use Internet Explorer.
|
|
