Dungeon Master Forum

Things are still weird here regarding logins and security:

• Recently, I've had to login again every day. It seems like the login cookie is not persisting.
• Chrome frequently blocks me from entering the site with its standard "Site is unsafe" warning page. I have to click through the Advanced button on that page to get to the site.

I think there's something wrong with the site's certificate and/or the way the secure and unsecure web addresses are linked. This stuff was always confusing to me when I used to admin the site, but I don't recall such problems on the host we used years ago. I wonder if there's something misconfigured with the current host? Anything I can do to help with that?

For the record, I'm not having any issues here - it keeps me logged in and I get no error messages? Maybe it's a browser thing? I use Firefox.

I'll try another browser for a while and see if that makes a difference. Chrome is normally pretty reliable, but I think its security filters black marked the site a long time ago. Maybe. Who knows!

I don't have any issue either. I mostly use Edge (though I have Chrome, Brave & Firefox).
I just quickly checked in Chrome, I don't have any warning message.

The site uses apache2 configured to listen on both http 80 & https 443. There is an automatic redirection from http to https for any URL configured in .htaccess at the root of the site with these 2 rules:
I use certbot to automatically enroll & renew the SSL certificate from Let's Encrypt.

Can you try with "private browsing" mode of Chrome?
Can you try to deleting all cookies for both dungeon-master.com & www.dungeon-master.com, and try again?
Can you try other browsers?
Maybe you have one extension in Chrome that would interfere? Like any antivirus or security/filtering/parental control tools. You can try disabling all your extensions to check if it works better.
Can you post screenshots of the error messages that you get ?

I checked the cookies for the site, and three exist while logged in. As soon as I close the tab and return to the site, when I check the cookies they have been deleted. I suspect Chrome is deleting them silently because it still thinks the site is unsafe.

I've added the domain into Chrome's "Always allow cookies" settings and it seems to now remember that I'm logged in at least. I've not seen the browser "unsafe" warning for a while, I'll keep an eye on that.

EDIT: Well, that didn't work. Chrome deleted the cookies again. Sigh. I don't really want to use a different browser just for one site. I'll see if I can get to the bottom of this.

Your screenshot shows an option for third-party cookies. The forum does not use third-party cookies, so this option should make no difference.
Testing with other browsers might help you locate the issue.
If you get the same behavior with other browsers, then you may have some external app that filters cookies (a security/privacy tool).
If the issue is only in chrome, this might be caused by a custom configuration setting (you may try restoring default settings https://support.google.com/chrome/answer/3296214?hl=en ), or an extension (you may try disabling them all).
Good luck!

Hey, so an update on this from my end - when I went to access the forum just now, I noticed I wasn't logged in (normally I'm perma-logged-in), and when clicking the Username and Password boxes it had a little pop-up thing under them saying the connection wasn't secure. I was still able to log in just fine (on the second attempt, as I couldn't remember my password at first ), but just thought I'd let you know.

The hosting company made a critical server update yesterday and there was some down time.
After that I also had to reconnect to the forum. No issue since them when coming back here. So I guess this only was transient issue, but please report here again if the same issue occurs again.

Just did again today, yes - went to forum, found I was logged out, had to log in and the username/password things had a little pop-up below them saying the site is unsafe/my info is not secure.

OK.. I wonder what is going on, as I don't experience this issue. You use Firefox, right ?

In order to troubleshoot this, if you can reproduce this issue, then please:
- Take a screenshot of the messages you see
- Please check the exact URL that is being used: does it start with http or https ? (you may need to click in the address bar as some browsers hide this by default)
- If using https, then please click the padlock icon on the left of the URL and check what certificate you get (please take a screenshot too)
- Please ensure that you do have cookies in your browser for dungeon-master.com. If you don't have cookies, there is no persistent session and you must login again.

I think I nailed it!
The http to https redirection was only working at the root of the site for URLs http://www.dungeon-master.com/ or http://dungeon-master.com/ but was not working anymore for URLs like http://www.dungeon-master.com/forum/* since one of the last phpbb updates I made some time ago (can't say which one) because of conflicting .htaccess files.

I guess you are still using old bookmarks or links that specify http instead of https, and these were not properly redirected to use https. That is why your browser would display the warning message about being unsecure. If you came here with http, you had issues. If you came with https all was fine. I suppose the cookie issues were not the cause but instead the consequence of using http.

I have fixed the redirection issue (I hope 100% this time) so please report again if you still have issues.

Well, can confirm that I'm certainly likely using a very old bookmark, since I've had no need to change where it points since I first made it, and whenever I get a new computer I just copy over the entire Bookmarks folder so as not to lose anything.
But whatever you did does seem to have fixed it - when I went to the forum today it just loaded as normal, already logged in. Yay!

Thank you for looking into this Christophe. At first I thought things were now fixed, but here's what happened for me:

My bookmark is for "http://dungeon-master.com/forum" (no www subdomain) -- I just visited that and was logged in right away: no warnings and no need to login from last time I was here. First time that's worked for a while.

I then edited my bookmark to the secure version "https://dungeon-master.com/forum" -- and got the warning page in Chrome. So it seems there might still be an issue with the redirect for the secure version of the domain without the www subdomain?

It's not an issue though: now that you've clarified and fixed the issue, I can simply change my bookmark to whatever is most reliable.

I could reproduce that issue in Chrome after creating a bookmark to "https://dungeon-master.com/forum" (no www.)
After clicking on the "Proceed" link once, the link worked afterwards. It seems Chrome remembers to ignore the issue.
The issue here is that the certificate is only valid for www.dungeon-master.com and not for dungeon-master.com.
If you reach the site with https://dungeon-master.com/, the certificate is invalid for that domain during that first connection, hence the warning. The browser then receives an HTTP 301 redirect response that sends it to the correct address that includes the "www." It seems browsers ignore the invalid certificate during that redirection, but not if you have bookmarked the address.
I have modified the certificate to now include both domains, this should fix that kind of warning message.

The "official" URL to set in your bookmark is: https://www.dungeon-master.com/forum/

Thanks for the explanation, that all makes sense now. It's strange I hadn't noticed that my bookmark didn't have "www" in it for all this time...! I blame getting old...