Randomly Logged in as a Different User

bguenger

Hello,

I've noticed this bug a few different times myself and I've had a few of my lab users report it as well.

Every once in a while (usually in Chrome browser), I'll go to my Repetier Server tab and instead of being logged into my admin account, I'll be logged in as a random different user. I'm the only person who uses my PC and I always log into my same admin account, so it seems like the system is just randomly sending me over to a different account.

I manage a university makerspace, so we have hundreds of users with unique accounts. I get the sense that most people use Repetier Server for smaller scale operations, but maybe I'm wrong. Could the scale of our implementation have anything to do with this error?

It's not really an issue if I get logged in as another user, but I don't want a user to randomly get logged in as an admin.

Any thoughts about why this might be happening?

Thanks!
Ben

Repetier

Are other users using same pc and has it personal accounts or are acounts shared?
If you check to remember login it sets a data package in local storage making you get the last user credentials having done so. When you cleanly do log out this gets cleared. Just closing tab makes it auto login again on opening the url. But from description it sounds like you are the only user of it so not the reason.

Apart from this make sure you have not send or bookmarked url with sessions. At least in older versions the session id might got reused with new account how logged in.

Which version are you currently using?

bguenger

I'm the only person using the PC, but the other users are sharing computers. They have their own user accounts on the computers.

We're on version 1.3.0 right now

Repetier

Ok, on 1.4.2 I had improved user management and I think around that time I changed session reusage with creating new session id, so you should check if upgrading solves the issue.

Did you check the url send to others for login if it had session in link?

bguenger

Sounds good; I'll try updating to the latest version and see if that helps.

For the record, I really appreciate your software and how responsive you are to my questions whenever I have them!

I'll post back here if I still notice the issue after updating.

Best
Ben

bguenger

Hi,

I finally updated to version 1.4.10 and today when I accessed the server, I was randomly logged in as a different user. It doesn't appear that the user management updates to the most recent version have fixed the issue. Do you have any new suggestions?

Thank you!
Ben

Repetier

Just want to note that I'm not forgetting this, also I can not reproduce it except with sharing links containing sessions. At the moment I plan to switch more to cookies to remove sessions from links and preventing any chance on this, but that is a complicated task with many code parts to modify!

Repetier

Ok, new cookie based gui version is now released. Hope it does not happen any more. Now sessions are not send via url so no involuntary mixing/sharing possible in regualar ui.

bguenger

Hello,

I just wanted to send an update that this issue is still happening on version 1.4.18

I have many users who access the server simultaneously, so could it have something to do with the number of active user sessions?

Thank you!
Ben

Repetier

No, I do not think number of users make a difference. My main problem is, that I never saw this happen and you are the only one reporting this, so I wonder how this can happen. Can you give more details on how or when that happens. At the end it all must depend on stored session I think. If a session is associated with an account it will show that until it is expired or user logges out. On the other side you said you are the only one using the pc, so are you always using same account ot do you sometimes swich the account and then you are back on that account? Or do you even have multiple tabs of server open. If so you should know that they would all share same account so logging out in one and loggin in as different user will make the switch sooner or later also on the other tabs sharing same cookies.