Users being automatically logged in, even after logging out

[findingpeace]

We have a big security issue here. Several users are reporting that when they log out, and then return to the site, they are still logged in. I have verified it from several different browsers / computers.

Is this a known issue with vBulletin 4.2.1?

Thanks!

[Lynne]

What is your site URL? What is your Cookie Domain? Have you tried clearing your cookies for the site?

[findingpeace]

Forum URL: ourdomain
Cookie domain: (blank)
Path to save cookies: /

Yes, I've asked them all to clear cookies and the problem persists

[Lynne]

Do you have an .htaccess file in place - if so, what is in it? Does your host have any caching enabled on the server (if you aren't sure, please ask them about ANY caching including just using mod_expires or mod_headers)?

[findingpeace]

Hi Lynne,

Thanks so much for your quick help.

.htaccess file is empty. However I remember turning on this option in config.php because someone told me it would make my site faster:

$config['Datastore']['class'] = 'vB_Datastore_Filecache';

Could that be the culprit? I've also opened a case with my hosting company to ask about caching options

[mokujin]

try to reupload file in ./includes/datastore/datastore_cache.php
I had same problem once few years ago.

[findingpeace]

Thanks mokujin! I have re-uploaded the file and also just commented out the line in our config file, since we don't really need the extra speed now that we are on a faster VPS

--------------- Added [DATE]1375457169[/DATE] at [TIME]1375457169[/TIME] ---------------

That did the trick, thank you both for all of the help!

[findingpeace]

Hi Lynne,

I spoke too soon, we're still having issues with this across multiple accounts. My host let us know that the following caching is enabled:

eAccelerator
mod_expires
mod_headers

Are these causing that issue?

[Lynne]

mod_expires and mod_headers will cause this issue if they are not written correctly.

[findingpeace]

Thanks! Do you know how I can check this? Is it in the apache configuration? Is there a recommendation/standard that I could send along to my hosting company to write it as?

--------------- Added [DATE]1375738366[/DATE] at [TIME]1375738366[/TIME] ---------------

Would it be worth just disabling both for testing?