Bug Login issues when using Proxy/VPN

[index026]

Hey guys I have to use a VPN to access the forum because my government(CN mainland)blocked this site.like google.
However,I met with some problem when using Proxy to login.The login expires so fast(1 or 2 sec),I must check the"remember me".or I will get kicked out after I logged in.(without the "remember me",my login should be expired after I close my web browser.Not like that)
Environment:Firefox 76 on windows 7 and linux,all met this,and I am sure my proxy is working.
Thanks for your help;

 

[Checkmate]

I'm pretty sure you're the only person to have this problem. The use of VPN or Proxy should be completely transparent: the system would not know if you are using a VPN or proxy until the intervention by a sysadmin to combat spam.

And I can confirm that it wasn't the case, so it could be your browser invalidating cookies.

 

[index026]

lol,I checked my browser on windows and Ubuntu,and discovered:
1.On Ubuntu,whether or not I checked the "remember me",always cannot login. Firefox 78.0.1 and chrome 83.0.4103.116(all 64 bit)
2.On windows 7 ,Firefox developer edition 76.0b3(64bit),if I checked the "remember me",can log in.
3.disabling cookie managment plugin and ad-blocking or use inprivate window cannot help.
that seems a crash in "index.php",of the front page.detailed info below:
View attachment 25020

 

[Checkmate]

When you attach something, please only attach, and do not try to insert it to the post. That way it will work. Right now it doesn't work. If you can give me a screenshot of the crash, we could discover something.

So I did a quick test on my Windows workstation via a VPN and it works right off the bat. I logged in to a troubleshooting account on Anime-Sharing without ticking remember me. It logged me in normally and stay logged for 5 minutes. I didn't test it for more than 5 minutes. I can say it works normally.

Browser: Chrome 64 bit.

 

[index026]

I recorded my screen on both win7 and Ubuntu.They're a bit different.
They can be found here:https://ufile.io/wj938bol

 

[Checkmate]

Javascript is executed in the client browser side. In this case, the purpose of the javascript is to hash your password, fetch or delete the cookie when you login and logout, it is being done by your own browser.

If this is indeed the problem, it means something on your side is actively blocking the javascript. Or trying the modify the javascript in the middle, I'm not sure which is the right case.

Check the secured version to see if there's any MITM attack, and compare the content of the script with the non-secure version

https://www.anime-sharing.com/forum/clientscript/vbulletin-core.js?v=423
vs
http://www.anime-sharing.com/forum/clientscript/vbulletin-core.js?v=423

Make sure your browser addon does not block the script.

I've tested it:
Firefox 78.0.1 (64-bit) both normal and private mode
Chrome Version 83.0.4103.116 (Official Build) (64-bit) both normal and incognito mode
Edge Chromium Version 83.0.478.61 (Official build) (64-bit) both normal and incognito mode

Can you try a virgin Palemoon browser (no plugin) and see if it works? This seems to indicate a client-side problem.

 

[index026]

seems like login.php went into problems.I am confused now...
see the screen record:https://ufile.io/z56vztxv

 

[Checkmate]

Ok, we are onto something. The qtip is a function for a small jquery tooltip being hosted on cloudflare backed cdn network. It do... tooltip on the forum interface (obviously)

Here are these the files here:
https://cdnjs.cloudflare.com/ajax/libs/qtip2/2.1.0/jquery.qtip.min.js
there's also this:
https://cdnjs.cloudflare.com/ajax/libs/jquery.imagesloaded/3.0.4/jquery.imagesloaded.min.js

Cloudflare turns it into https by default. Can you tell me if you can load these scripts? (Click on it, does it show the content on your browser)

 

[index026]

okay I installed palemoon,a fresh installtion. As it did't have advanced settings like firefox to make a Proxy:"manually",So I set my software to Proxy all the flow on my computer(I usually to make it connect directly,only set the browser to use proxy,"manually".)
So 1.palemoon,Inprivate window,unchecked "remember me":login success.
2.palemoon,normal window,unchecked:login success
3.Firefox 76.0b3 on Windows 7,64 bit:login success(use the setting:use this computer's Internet connection settings,and make software to proxy all the flow)
4.Firefox 78.0.1 on Ubuntu 18.04,64bit:login failed(use the setting:use this computer's Internet connection settings,and make software to proxy all the flow)[both checked the"remember me" and unckecked,nothing changes]

And,using https script changed nothing.

screen records:windows:https://ufile.io/l6ph95td https://ufile.io/lkwk90p5
linux:https://ufile.io/p4u5wbq2


So maybe it is because some minor difference between linux and windows,the browser on them,and even how the proxy soft work on two platforms.
I am not a really professional user that I donnot understand why using"manual Proxy"setting is different.And on linux,for now(using chrome and firefox),there is completely no way for me to login.So any professional advice from linux users?

p.s:the proxy soft used called shadowsocks,it can break the GFW more efficently...VPN performs bad in China now.

 

[index026]

Ok, we are onto something. The qtip is a function for a small jquery tooltip being hosted on cloudflare backed cdn network. It do... tooltip on the forum interface (obviously)

Here are these the files here:
https://cdnjs.cloudflare.com/ajax/libs/qtip2/2.1.0/jquery.qtip.min.js
there's also this:
https://cdnjs.cloudflare.com/ajax/libs/jquery.imagesloaded/3.0.4/jquery.imagesloaded.min.js

Cloudflare turns it into https by default. Can you tell me if you can load these scripts? (Click on it, does it show the content on your browser)

all functions nomally.

 

[Checkmate]

At this point, I genuinely have no idea why. The fact that checking remember me box is to tell the forum backend to create a cookie that is longer than 30 days and nothing else, if you can log in with remember me being checked, you must also be able to log in with remember me is not checked. The only difference between the two-mode is the cookie value. It makes no difference to the browser.

As your screencap also display some problem with JavaScript, I am not sure if that is the case. I have no such error during testing with the browser above.

In regards of shadowsocks, I've never used them, but I read about it. It has two components, a client, and a server, very similar to how VPN works - but adopt Socks5 protocol. This still doesn't explain the browser invalidate your session in near-instant.

Unfortunately, I am unable to help you to fix this problem or provide you further clue on how to fix this.

 

[index026]

Really that you for your effort to help me out.Appreciate your efforts.

 

[index026]

OK, after all these days of tests I can say that it's some kind of bug on Linux's Firefox and chrome .On Windows and Android the login works well.

 

[Checkmate]

That would be strange. Anyhow, I don't want to poke it further, but I'll keep that in mind when I work on the next AS Community 2.0. It is a major rehaul version in development for a while now.