• How logging in to post SHOULD work

    From Retro Guy@retroguy@novabbs.com to rocksolid.nodes.help on Mon Jul 15 13:09:17 2024
    From Newsgroup: rocksolid.nodes.help

    Here's how this is supposed to work. I've recently made some fixes so
    hopefully this is correct.

    When you click Post or Reply, the post page comes up and includes your username/password prompts. If you are not logged in, you can edit these prompts. If you are logged in, they are not editable (password always
    shows as asterisks and it's not actually saved anywhere. The server
    never knows your password).

    Staying logged in requires cookies and javascript. Else, you just need
    to authenticate for each post. You can still post without javascript or cookies.

    Knowing if you are logged in (the server knowing) is based on whether
    you have passed the username/password check, of course, then the server maintains that you are logged in for a while (and sets some cookies).

    This "while" is based on auto rotating keys that rotate every 4-8 hours,
    so you can be considered NOT logged in after 4-8 hours. If the keys are
    still ok (checked on server vs. cookies), your cookies are checked that
    they match some hashes of some server side account info per user (in
    addition to keys). Lastly, your ip address is checked to see if it has
    changed. If your ip address changes, you must re-authenticate.

    That is how it is meant to work. If it does not, please let me know what happens and I'll continue to try to improve it.
    --
    Retro Guy
    --- Synchronet 3.21a-Linux NewsLink 1.2