ASMO wrote: Tue Oct 25, 2022 7:07 am
Ymx wrote: Sat Oct 22, 2022 4:41 pm
ASMO wrote: Thu Oct 20, 2022 7:59 am
Hi All
I have checked every setting and i cant see anything that could possibly be causing this, i use multiple browsers on multiple devices and have never had an issue, i will keep looking, apologies for any inconvenience caused.
Can you switch on the redirect to https?
This should help I think.
https://www.phpbb.com/community/viewtop ... &t=2501786
Or break the forum ?!
Redirect has been switched on since day 1
Just FYI
Code: Select all
* About to connect() to notplanetrugby.com port 80 (#0)
* Trying 91.238.162.176... connected
* Connected to notplanetrugby.com (91.238.162.176) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.44 zlib
/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: notplanetrugby.com
> Accept: */*
>
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0<
HTTP/1.1 200 OK
< Connection: Keep-Alive
< Keep-Alive: timeout=5, max=100
< set-cookie: phpbb3_cjfhd_u=1; expires=Sat, 28-Oct-2023 13:48:04 GMT; path=/; domain=notplanetrugby.com; secure; HttpOnly
< set-cookie: phpbb3_cjfhd_k=; expires=Sat, 28-Oct-2023 13:48:04 GMT; path=/; domain=notplanetrugby.com; secure; HttpOnly
< set-cookie: phpbb3_cjfhd_sid=5609cfa7723b9c082f6874b77aede11c; expires=Sat, 28-Oct-2023 13:48:04 GMT; path=/; domain=notplanetrugby.com; secure; HttpOnly
< content-type: text/html; charset=UTF-8
< cache-control: private, no-cache="set-cookie"
< expires: Fri, 28 Oct 2022 13:48:04 GMT
< referrer-policy: strict-origin-when-cross-origin
< transfer-encoding: chunked
< date: Fri, 28 Oct 2022 13:48:04 GMT
< server: LiteSpeed
No redirect, just gives a 200 then gives you the page content.
I guess these are the culprits:
Code: Select all
< set-cookie: phpbb3_cjfhd_u=1; expires=Sat, 28-Oct-2023 13:48:04 GMT; path=/; domain=notplanetrugby.com; secure; HttpOnly
< set-cookie: phpbb3_cjfhd_k=; expires=Sat, 28-Oct-2023 13:48:04 GMT; path=/; domain=notplanetrugby.com; secure; HttpOnly
< set-cookie: phpbb3_cjfhd_sid=5609cfa7723b9c082f6874b77aede11c; expires=Sat, 28-Oct-2023 13:48:04 GMT; path=/; domain=notplanetrugby.com; secure; HttpOnly
I'm no webdev, but:
https://developer.mozilla.org/en-US/doc ... TP/Cookies
A cookie with the Secure attribute is only sent to the server with an encrypted request over the HTTPS protocol. It's never sent with unsecured HTTP (except on localhost), which means man-in-the-middle attackers can't access it easily. Insecure sites (with http: in the URL) can't set cookies with the Secure attribute.
So the problem is twofold:
One, you're setting cookies only when SSL is used.
Two, the SSL redirect is not happening. Instead of the 200, I'd expect to see something like this:
Code: Select all
HTTP/1.1 301 Moved Permanently
< Date: Fri, 28 Oct 2022 13:54:03 GMT
< server: LiteSpeed
< Location: https://notplanetrugby.com/
) and upgraded the phone to ios16. None of that has helped. I can't keep my phone logged into this site. It's mildly annoying. No issues with FF on my laptop.
