Users being automatically logged in, even after logging out
 

We have a big security issue here. Several users are reporting that when they log out, and then return to the site, they are still logged in. I have verified it from several different browsers / computers.

Is this a known issue with vBulletin 4.2.1?

Thanks!

What is your site URL? What is your Cookie Domain? Have you tried clearing your cookies for the site?

Forum URL: ourdomain
Cookie domain: (blank)
Path to save cookies: /

Yes, I've asked them all to clear cookies and the problem persists

Do you have an .htaccess file in place - if so, what is in it? Does your host have any caching enabled on the server (if you aren't sure, please ask them about ANY caching including just using mod_expires or mod_headers)?

Hi Lynne,

Thanks so much for your quick help.

.htaccess file is empty. However I remember turning on this option in config.php because someone told me it would make my site faster:

Could that be the culprit? I've also opened a case with my hosting company to ask about caching options

try to reupload file in ./includes/datastore/datastore_cache.php
I had same problem once few years ago.

Thanks mokujin! I have re-uploaded the file and also just commented out the line in our config file, since we don't really need the extra speed now that we are on a faster VPS

--------------- Added [DATE]1375457169[/DATE] at [TIME]1375457169[/TIME] ---------------

That did the trick, thank you both for all of the help!

Hi Lynne,

I spoke too soon, we're still having issues with this across multiple accounts. My host let us know that the following caching is enabled:

eAccelerator
mod_expires
mod_headers

Are these causing that issue?

mod_expires and mod_headers will cause this issue if they are not written correctly.

Thanks! Do you know how I can check this? Is it in the apache configuration? Is there a recommendation/standard that I could send along to my hosting company to write it as?

--------------- Added [DATE]1375738366[/DATE] at [TIME]1375738366[/TIME] ---------------

Would it be worth just disabling both for testing?

Remove all the lines and see if it works fine then. Then only add back lines for images and such.

I've removed expires, headers, and eAccelerator. Restarted Apache, asked users to clear cookie/cache - they're still having the issue. I even shared screens with them to verify, and it's definitely happening. They click logout, get the "Cookies have been cleared" message, and then go back to the site and are logged in

--------------- Added [DATE]1375754576[/DATE] at [TIME]1375754576[/TIME] ---------------

Here is my apache configuration:

I would suggest posting in the Server Configuration forum over on vbulletin.com for help setting up your server correctly so the caching is disabled for the php pages on your site.

Hi Lynne, thank you! They let me know that the issue is allowing both www and non-www access (instead of picking just one), so the cookies remained on one, even if logged out on the other.

Problem is officially resolved

Really appreciate all of your help!!