How logging in to post SHOULD work
From
Retro Guy@retroguy@novabbs.com to
rocksolid.nodes.help on Mon Jul 15 13:09:17 2024
From Newsgroup: rocksolid.nodes.help
Here's how this is supposed to work. I've recently made some fixes so
hopefully this is correct.
When you click Post or Reply, the post page comes up and includes your username/password prompts. If you are not logged in, you can edit these prompts. If you are logged in, they are not editable (password always
shows as asterisks and it's not actually saved anywhere. The server
never knows your password).
Staying logged in requires cookies and javascript. Else, you just need
to authenticate for each post. You can still post without javascript or cookies.
Knowing if you are logged in (the server knowing) is based on whether
you have passed the username/password check, of course, then the server maintains that you are logged in for a while (and sets some cookies).
This "while" is based on auto rotating keys that rotate every 4-8 hours,
so you can be considered NOT logged in after 4-8 hours. If the keys are
still ok (checked on server vs. cookies), your cookies are checked that
they match some hashes of some server side account info per user (in
addition to keys). Lastly, your ip address is checked to see if it has
changed. If your ip address changes, you must re-authenticate.
That is how it is meant to work. If it does not, please let me know what happens and I'll continue to try to improve it.
--
Retro Guy
--- Synchronet 3.21a-Linux NewsLink 1.2