Access token mailed to my user wont work sometimes?

Nicklas

Facts: osTicket 1.9.16 have runned so many years no problem and using PHP 5.6!
Update some days ago to 1.18.2 without problem all work as expected. Made the update because my host close PHP_5.6 down.

I have one big problem with the access token mailed to my user.
Example on the random token, https://support.myhost.com/view.php?auth=o1xjecaaacvbaaaaH8Erhz76SshfgA%3D%3D
Sometime the link work, and we see the ticket directly when click my url.
But other time it don't work, and they get the user login page, but cant login!
I found this solution, if clear the cookies then it work again.

My Setting:
User:
Authentication Token: Enable (use of authentication tokens to auto-login users )
Client Quick Access: Disabled (Require email verification on "Check Ticket Status" page )

What can be problem here?

KevinTheJedi

Nicklas

Sounds like session issues. Since all your users are guests it’s quite strange as typically session issues are with the opposite; registered users. We even had a patch that addressed guest session issues here:

https://github.com/osTicket/osTicket/pull/6766/commits/416b548bd812188fec62c89fe8bfb0a3128731a1

Maybe try reverting this patch, clearing all cache/cookies/sessions, and retesting for a while?

Cheers.

Nicklas

I test it out and report back, in some days.
I can see it was the code from osTicket-v1.18.1, so maybe newer is not always better:-)

Nicklas

May i ask, i see so many having problem with sessions the suggested fix is to roll back some change.
The file class.ostsession.php from 1.18.1 have only 2 major change compared to 1.18.2 and the first is the suggested fix. I see other where the suggested fix is to roll back the other part in the file.

I have a test installation where i now use the class.ostsession.php from 1.18.1 in a 1.18.2 installation and see no problem using that file, and it fix all my problem too.

So why not use class.ostsession.php from 1.18.1 in the 1.18.2?

KevinTheJedi

Nicklas

Maybe you don't understand development or versioned releases? v1.18.2 is newer than v1.18.1. The patch was added to v1.18.2 to address Guest Session issues we were having in v1.18.1. This patch inadvertently affected registered user sessions. So this means in v1.18.3 this patch will be reverted and/or improved upon.

Cheers.

Nicklas

After included you suggestion...
Now after testing for some days i have many customer where the mailed url token wont work and they get the login page but cant login. Then i rolled back to the originally file from 1.18.2 i started with and having the same problem.

After some days i as i get this problem myself when logging in to /scp
Authentication Required
Cant login at /scp it just say Authentication Required
Then i remove cookies then it say Invalid CSRF Token CSRFToken
Then one more time i can login.

Something is not right in 1.18.x i came from a 100% working 1.9.16 but the php v5.6 was closed by my host, therefore the update.

What is all this about. Du you have a suggestion?

KevinTheJedi

Nicklas

In that case the patch I linked above is the fix for that. Go read other related threads; this is the patch that resolves your issue.

Cheers.

Nicklas

So you suggest i put your suggestion back to the site?

KevinTheJedi

Nicklas

Yes, in order to address the login issues you must revert the patch linked above. You replace what's in green with what's in red. You must also restart the server and PHP-FPM if you're running it so the changes are applied.

Cheers.

KevinTheJedi

Nicklas

You will also need to clear all cache/cookies/sessions after making the change to ensure old sessions are not being used.

Cheers.

Nicklas

Will you clear the sessions table in the osticket db?

KevinTheJedi

Nicklas

You can if you want to nuke everyone's session (Agents and Users). Users/Agents may still need to clear their existing session/cookies in the browser though; especially if they are stuck.

Cheers.