I've never used the "Bind Agent Session to IP" setting, it is disabled by default.
I have tried:
define('TRUSTED_PROXIES', '*'); as well as define('TRUSTED_PROXIES', $__SERVER['HTTP_X_FORWARDED_FOR']);
in the config file. It doesn't make any difference at all.
The session works for about 5-10 minutes after I empty the ost_session table and then randomly goes into an authentication required loop until I empty the session table again.
Upon inspection, $_SERVER['HTTP_X_FORWARDED_FOR'] holds two IPs: my own IP and the IP of the Cloudflare server.
Why can't you implement a normal cookie-based authentication scheme, like this forum right here? It hasn't required a new login for me all day! 🙂