session / login problem on appfog

[Rob]

I've been giving the appfog.com service a spin and although, for the most part, it looks like a promising alternative to a traditional VPS or dedicated server, I'm having some weird behaviour with trying to login to my vanilla PW site that I've set up.

Because, unless i'm mistaken, I can't do a regular install and have PW create the DB for me (the appfog architecture doesn't have a "root" DB user that has DB create priveliges), I basically created the entire site locally (in a linux VM with my dev tool in) then uploaded the code and synced the DB over to the DB service running on appfog.

Now, I seem to sometimes be able to login to the site, and sometimes it rejects me and tells me to wait X number of seconds before I try again. A couple of days ago I couldn't log in at all, then today it let me in first go, but then a minute or two later it inexplicably logged me out again. Now I have similar sporadic behaviour. I log in eventually, then it randomluy logs me out again.

The difficulty here is that, as is the case with a Saas, I don't know the full ins and outs of their system and how it's all setup, but their support tell me that file-based sessions ought to work and there aren't and unusal settings, file permissiosn etc. I can confirm that session fiels are being created within the filesystem of my app o ntheir servers, but for some reason it only sporadically seems to be able to access/use those session files or they are "timing out" in some way. I have checked the phpinfo() and nothing jumps out at me, file-based sessiosn are enabled with 180 second timeout, nothing unusual as far as I can tell.

Does anyone else here use appfog? I have found threads here about phpfog but this is their newer, most likely quite different, system that can host a varierty of techologies, not just PHP.

Any advice gratefully received!

[ryan]

Because, unless i'm mistaken, I can't do a regular install and have PW create the DB for me (the appfog architecture doesn't have a "root" DB user that has DB create priveliges)

I'm not familiar with this architecture, but wanted to mention that ProcessWire doesn't need DB create privileges. It just needs for you to specify what DB it should use (one that is already created by someone with privileges to do so).

Now, I seem to sometimes be able to login to the site, and sometimes it rejects me and tells me to wait X number of seconds before I try again.

If that behavior is annoying, you can also disable it by uninstalling the SessionLoginThrottle module.

A couple of days ago I couldn't log in at all, then today it let me in first go, but then a minute or two later it inexplicably logged me out again. Now I have similar sporadic behaviour. I log in eventually, then it randomluy logs me out again.

180 second timeout is really short: 3 minutes. This could be the entire problem right there. I would suggest bumping that up to 3600 (1 hour). But if that's not it, try these:

Try editing your /site/config.php and changing the $config->sessionFingerprint line to false.

If that doesn't fix it, try adding this line to your /site/config.php: $config->protectCSRF = false;

The only other possibility I can think of is if there isn't enough disk space... or something weird with the cookie domain? (switching between hostnames on same site?). But I'm really thinking this has to do with the 180 second timeout. You may think that's enough, but there is some randomness in how PHP's garbage collection of sessions works, and what their GC settings on the server are and maybe (?) that's causing some unexpected/random behavior here.

[Rob]

Thanks Ryan.

I've increased the session timeout and also disabled the session fingerprint and it works now. I tried it with just an increased session timeout and I had same problems, so it must be the dynamic IP issue you mentioned. I am on a consumer broadband provider at home so it may account for the issue.

I don't have a huge understanding of these things, but I thought that the concept of dynamic IP meant that my home IP address will be allocated from a pool of addresses that the provider has. I didn't think it meant that the IP was shifting every few minutes or with every request, but I guess it must be if this is the cause of the session being lost.

Thanks for the pointers.

[ryan]

I'd be surprised if your IP is changing that often on a cable/DSL setup. If it were going through some wireless service, then it might be more likely to change often. Session fingerprinting also looks at the user agent string... is it possible anything is changing in that? (some browser plugin changing it or something)?