Logins and AOL

[Nutter]

One of my users sent me an email today that they are not able to login using the AOL browser. IE's fine. And they're able to browse other sites through AOL that require cookies, logins, and presumably sessions (how I'm keeping track of the login). But on mine they just keep looping back to the login page.

I've seen pages describing AOL causing problems because it's coming through a proxy and multiple IP addresses, but these seem to be only when the IP is used as part of the session id. I'm just using session_start().

I'm also thinking that it may be a cache problem, but wanted to check with y'all before I start sending them patch files for a WAG, and I don't have AOL to test with.

[edited by: Nutter at 1:31 am (utc) on Sep. 28, 2006]

[jatar_k]

I would look at your authentication first

once they login, what do you set in the session

then what do you test for authentication?

you could also see if you can find them in your logs, do you log failed logins? It would help if you do, then you could see if it was a login issue or an auth issue.

[Nutter]

Logins are logged, and they are showing as successfully logging in each time they try.

If the login is successful then a $_SESSION variable is set by the script and then redirected back to index.php. Index checks for this variable and if it's there, and valid, then it shows the page. Otherwise it shows the login page.

The AOL people that are having problems are just cycling back to the login page. Were the login incorrect then they would see an error message, which isn't displayed when they bounce back to the login page.

[jatar_k]

so your auth is dying

hmm, no db based session management? I am guessing no.

Just a single var? something like this?

if (!isset($_SESSION['somevar'])) {
include 'login.php';
}

[Nutter]

Good guess - file based sessions. I suppose I could save a cookie with a session id and store that in a table. But I thought that was pretty much what PHP was doing under the hood whether it's DB or file based.

And almost exactly like your example, except for the variable names :)

[jatar_k]

your own file system or just the regular stuff

what do you use for the filename? is it anything that relates to IP, some kind of hash using the ip

you would think there would be something ip related in this scenario which was causing it to bomb

know any of these people, or anyone with AOL and you can test it?

[Nutter]

Thank you, indirectly. I went back and looked at how my if isset was done and I'm using the IP address as part of the login check. From what I've read here and another places the AOL proxy comes to a site through multiple IP addresses and if I'm checking the IP as part of that then it'll cause a problem.

I hate spending a few hours looking for a solution, only to have found it in the first 2 minutes and just missed it :)

[edited by: Nutter at 2:11 am (utc) on Sep. 28, 2006]

[jatar_k]

nice catch

yeah, IP can wreak havoc, I still track it, to watch changes but it is difficult to use as a check.