Security token error

[CorbinH]

One of our members has just received this message.
He states that it appeared after he was away from his computer for a few minutes.

[In Omnibus]

That's expected behavior. If you leave the forums on a specific page for more than I believe it's 15 minutes you will get that error because the cookie times out.

[CorbinH]

Okay, thanks for the quick reply. We'll keep an eye on it and see what happens
Could it be also be something to do the the auto-save time setting?

[Wayne Luke]

Could it be also be something to do the the auto-save time setting?

It is a standard security feature. Every page load has a security token embedded in it. This allows the server to verify that form input comes from your site and not some other random site that is trying to phish your users for information. These tokens have a limited lifespan and change per user. The auto-save may have triggered the error. Refreshing the page should resolve the error.

[NumNum]

I know this is an older thread, but if you select the hyperlink in the message it brings me too a 400 page. Is this normal on a ssl site?

I only get it on my cell phone (apple) as i sometimes don't close out the page (safari) properly.

I suspect it is normal as the token times out and perhaps no longer recognizes the url?

[Wayne Luke]

It is a link to the Contact Us page specified under Settings -> Options -> Site Name / URL / Contact Us Details. Loading a new page loads a new Security Token. Security Tokens are never included in the actual URL. That would defeat the entire purpose of a Security Token.

[NumNum]

What would return a 400 error then?

[Wayne Luke]

The 400 Bad Request error is an HTTP status code that means that the request you sent to the website server, often something simple like a request to load a web page, was somehow incorrect or corrupted and the server couldn't understand it.

Your web server returned this what is the full error in its access logs and what is that URL that was incorrect?

[NumNum]

I’ll check the error log but I suspect it is the embedded link in the message that goes here;

https://xxxx-xxxxxxx.org/%251$s

It should go to the contact us form, no?

[NumNum]

Access logs;

xx.xxx.xxx.xx - - [20/Apr/2019:08:34:59 -0400] "GET /%251$s HTTP/2" 404 12565 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Mobile/15E148 Safari/604.1"

xx.xxx.xxx.xx - - [20/Apr/2019:08:34:59 -0400] "GET /js/privacy-consent-banner.js?v=545 HTTP/2" 200 1153 "https://xxxx-xxxxxxx.org/%251$s" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Mobile/15E148 Safari/604.1"

xx.xxx.xxx.xx - - [20/Apr/2019:08:34:59 -0400] "GET /css.php?styleid=1&td=ltr&sheet=css_b_modal_banner.css&ts=1555431637 HTTP/2" 200 407 "https://xxxx-xxxxxxx.org/%251$s" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like M

[Wayne Luke]

There should not be a %251$s in any URL.

What is the result of this query:

SELECT * FROM routenew WHERE name='contact-us';

There have been some issues fixed with the privacy consent in versions after 5.4.5. You may be running into one of those issues.

[NumNum]

I get the following back;

 localhost/renamed_db/routenew/        https://.hostname.com:2083/cpsess9242804887/3rdparty/phpMyAdmin/db_qbe.php?db=xxxxxx_db&token=54b8bcda6e5747a0e27e9df6751f8030





        Your browser has phpMyAdmin configuration for this domain. Would you like to import it for current session?        
        Yes
        / No
        / Delete settings



 Showing rows 0 -  0 (1 total, Query took 0.0010 seconds.)

 Switch to visual builder

SELECT * FROM routenew WHERE name='contact-us';



15    contact-us    NULL    contact-us    contact-us    vB5_Route_Page    page    index        a:1:{s:6:"pageid";s:1:"5";}    5    vbulletin    vbulletin-4ecbdacd6a6f13.66635713    NULL

[Wayne Luke]

That looks correct. I suggest upgrading as a race condition could make the variable incorrect in specific rendering of the page.

[NumNum]

Resolved via 5.5.0 upgrade.