[curry684]

Hi all,

I'm building a site that hops aboard the registration/login facilities of an existing vBulletin installation. I've set up the forum and main site on the same domain, and configured the cookies to be shared between both domains.

On the main site I have a plugin that loads the vBulletin core if required, and lets it detect whether there is a valid login going on. From a performance perspective however, I don't want to spend 0.05 second or whatever it is loading up vBulletin if it's not really required, so I'm using some smart code that only loads it when either the 'bbuserid' or 'bbsessionhash' cookies are set, iow only when the user is logged in to the forum. I then load vB, detect a login, look up the matching front-end data and use that for the rest of the session. Through a session cookie I then enforce that vBulletin is not included in subsequent pageviews.

All fine and dandy, and an extremely worthwhile optimization given that we're talking about a site with 300k unique visitors per month here. However, the one situation not covered here is if the user visits the main site, and then logs out on the forum, and returns to the main site. Since the session data is still valid and vB is not reloaded, the code there still thinks the user is correctly logged in.

Now what I wanted to do was store the bbuserid and bbsessionid cookies during the session, so I can detect changes in them to restart vB authentication, but then found out that bbuserid is only set if you check the 'Remember me' box, and bbsessionhash appears to change like every pageview, disqualifying both for reliable use in this situation.

Are these assumptions correct, and if so, how would I go about detecting a vB login change or logout without reloading the vBulletin core for every page?

A possible solution would perhaps be to write a plugin for vBulletin which stores another session cookie containing the current userId, also for temporary logins, but I'd like to keep the auth system outside vB as much as possible so that I can keep that a 'vanilla install'.