Mother of all “PW persists in logging me off” threads

[ErikMH]

There are quite a few threads here where users report ProcessWire repeatedly logging them out (see below). I, too, have had this problem intermittently over the two years I’ve been using PW. I was able to reduce the problem somewhat about a year ago by turning fingerprinting completely off — but the problem has never completely gone away.

I’m now at my wits’ end: I was unexpectedly logged out a half-dozen times again earlier today, though I could never see a pattern. As of an hour ago, though, every single time I try to update a field definition, the change is discarded and I’m logged out.

Using a different browser helped for a few minutes, but then it began having precisely the same predictable problem.

• Fingerprinting is off altogether ($config->sessionFingerprint = false;).
• CSRF protection is off ($config->protectCSRF = false;).
• I have installed the Session Handler Database, so my /assets/sessions/ folder is empty.
• This is my PW development environment, running on my MacBook Pro (M1 Max, current MacOS) via DDEV and Colima; restarting the environment has no effect.
• I do use Cloudflare WARP/1.1.1.1 on my Mac, though that shouldn’t be relevant; turning it off has no effect.
• session.gc_maxlifetime is the default  1440
• session.gc_divisor is the default  10001

I would like to fix this problem for good and never see it again, so that I can get back to far more important work.

Does anyone have any ideas?

---

Chronological (probably not comprehensive) list of relevant threads that I’ve read thoroughly:

 

 

 

 

 

 

 

 

 

 

 

[ErikMH]

I should add that I am now often (but not always) seeing an error dialog that says:

> Unknown error, please try again later

and then I’m shown a rather alarming (but, fortunately, totally spurious) empty listing of pages:

[Jonathan Lahijani]

Is this happening on other PW installations on the same machine and separate/similar DDEV environment?

Did you check apache error logs for anything suspicious? 

[bernhard]

9 hours ago, ErikMH said:

> Unknown error, please try again later

This error appears usually when you try to load the page tree but you have been logged out (which makes sense in the context of this thread). The AJAX request fails and is not properly explained to the user (this could be improved).

To your problem: Are you running on Apache or maybe something like nginx? Anything else non-standard? Which browser are you using (I read something somewhere that some browsers change fingerprints for more privacy...)? Can you reproduce that on a fresh installation of PW?

[flydev]

Interesting, again..

12 hours ago, ErikMH said:

running on my MacBook Pro (M1 Max, current MacOS) via DDEV and Colima

Since when ? Is "current MacOS" == Ventura, correct? is the problem worse than before? 👇

12 hours ago, ErikMH said:

restarting the environment has no effect

Did you enabled ddev mutagen or not ?

12 hours ago, ErikMH said:

session.gc_divisor is the default  10001

Is this a typo ? Just asking because default value are:

; Default Value: 100
; Development Value: 1000
; Production Value: 1000

Making garbage collector chance jumping from 1% to 0,001%. It could be a hint as it can mean you are overriding things somewhere. Also, take into account that if the gc is misconfigured, it will impact DB session.  A dump of phpinfo() would not be too much here to help.

Depending on the second question above, did you enabled a caching mechanism? For example (it's just to illustrate) on a production site behind Cloudflare, without a proper configuration, you will end up logged out on every click click.

Another thing should be to check the logs of php-fpm with journalctl.

[ErikMH]

Thank you all very much for your suggestions for further research; I am consistently amazed by the high quality of responses here, as well as the high signal-to-noise ratio!

I owe you an update:  As I mockingly predicted to myself, the mere act of writing the OP seems to have fixed the problem. Of course, I know this *isn’t* really true, but in truth I have not been unexpectedly logged out even once since I posted here two days ago — astonishing, given that I’d gotten logged out at least 25 or 30 times in the two or three hours leading up to my post.

In a perfect world, I would hunt this down ASAP *before* it bites me again. Pragmatically, though, I have to admit that I’m on deadline and there are more immediately pressing concerns.

Again, I am very grateful for all of the various pointed questions; they will be the first place I turn when the problem returns. And I promise to update the thread with more info when that happens!

In the meantime, thank you, @Jonathan Lahijani, @bernhard, & @flydev!