Remembering logged in status

Post by **FireFox31** » 10 Feb 2022, 21:33

When I visit MVS directly by typing in the URL, I am not logged in. When I click through a Google search to MVS, I am logged in. When I log in, I have checked "Remember me" and MVS creates 15 cookies. I am using Firefox on Windows with uBlock Origin running.

For the past eight months, I've visited MVS by typing https://matthewsvolvosite.com/forums/viewforum.php?f=1 in my URL bar, letting the browser auto-complete it. This takes me to MVS, logged in, showing me the latest posts. A few days ago, I clicked through to MVS from a Google result and got some weird error which I kind of ignored. Now, I'm no longer logged in when I visit the site directly.

I've deleted the MVS cookie (Firefox only lets me delete all 15 as one entry) and rebooted my computer. The problem is still present. What could be causing this odd behavior? Does anyone else access the site in the same way that I do?

Post by **matthew1** » 10 Feb 2022, 22:11

Hi FF. The domain is www.matthewsvolvosite.com... with "www".

Cookies see the www and non-www as two different sites. Non-www is redirected to www, but the difference still is huge. Like the difference between MVS and say Yahoo.

With that in mind, can you look in your cookies for www.matthewsvolvosite.com and matthewsvolvosite.com and delete all of them. Then try testing.

Tomorrow I'll give it a go and try to replicate what you're getting.

I also suggest trying with an alternate "clean" browser to see if you see the same behavior as you do with FF.

Post by **FireFox31** » 12 Feb 2022, 20:20

Wow, your keen attention spotted the problem. Reviewing my history I see that on 2/1/22, a click-through from a Google search sent me to http://matthewsvolvosite.com and gave me the security error. Even since, my browser URL bar auto-complete for the site was changed to remove its www. Thank you for your help. I'm glad there's no actual problem with me or the site.

The Google search I ran was:
geronimo site:matthewsvolvosite.com
Even now, three of the first ten results link to MVS without the www. I've used this site specific search many times (before and after 2/1/22) but I have always been taken to the www domain except for that one time. I wonder if Google changed recently or if the non-www links have always been there yet I managed to never click one (and I've clicked very many).

Post by **matthew1** » 13 Feb 2022, 09:56

Yeaa, Google.

The tag in the page

Code: Select all

<link rel="canonical" href="https://www.matthewsvolvosite.com/forums/viewtopic.php?t=98286&amp;start=40">

... tells Google and everyone that the canonical (true, trusted, only) URL for that page is with the www. It's been like that for years, yet here we are. You can see it on line 22 if you View Page Source.

All 130K indexed pages here do the same thing.

Why your browser isn't redirecting to www like mine are, I don't know. That is something I can't explain or control (further). That's why I'm always curious to know if another browser of yours does the same thing. That's always a good "litmus test" for these things. If say another browser of yours does the same thing, we might look at your ISP.

I keep a mega-pure browser available for just these things. It's Opera, but you can use really any. I have Opera set to clear everything on start up (or shutdown, I forget). I think it does a factory reset, but I'd have to check. It has 0 plugins/extensions. I also keep a near-pure Safari around for a second opinion. I don't trust my daily Chrome browser for these things.

Why? After a few years, tens of thousands of pages browsed, thousands of cookies, and a handful of plugins, no browser can be expected to work properly when diagnosing a problem and looking for the solution that works for "everyone", which is my task.

Post by **FireFox31** » 03 Aug 2022, 17:13

In case anyone else is wondering, I've attached screen shots of the offending search results (without the www) and the SSL error shown by my Firefox browser.

Admins could merge this thread into the actual thread for the problem: Security error when clicking from Google to MVS

Post by **matthew1** » 04 Aug 2022, 12:53

there are two problems here: a certificate problem and a Google problem, and they're actually not related
the SSL certificate is valid for www.matthewsvolvosite.com and not matthewsvolvosite.com [fact] *
the non-www pages 301 redirect to www counterparts at the server [fact]
destroying and recreating the cert with both domains will almost certainly fix the cert warning, but carries risk of fiasco, which would cause downtime

After some research and thought, here's my working theory:

For a minute I thought Google was indexing non-www pages, and those pages might not have the "www" in their canonical tags. That would make those competing pages with... themselves, the www pages. But no, any request for a non-www page redirects at the server, so the browser (and thus Google bots) never get any response other than a www (correct) page.

This all doesn't mean that matthewsvolvosite.com domain not having a cert isn't causing a follow-on problem of Google indexing them incorrectly, because anything is possible. But I don't think I need to be a Google engineer to say, from what I know, that this isn't expected or proper Google indexing and search result behavior.

This URL is helpful in this battle: https://www.google.com/search?q=https%3 ... +FireFox31

I'm going to lock the other topic rather than merge. Merging just strict merges them chronologically, and sometimes replies make no sense because of it. And I don't want to edit post times post-merge to fix it after a merge. Locks are cleaner and faster.

* this is of course the cause of the warning you get, FF31.

Post by **matthew1** » 04 Aug 2022, 12:56

No wait, ignore all that

seriously

https://www.redirect-checker.org/index.php try that tool with a non-www forum URL

edit: or better: https://wheregoes.com/trace/20223935857/

Post by **matthew1** » 05 Aug 2022, 13:05

Ok, picking this back up.

https://wheregoes.com/trace/20223935857/ so that shows a 200 code (all good), with 0 redirects.

But that should show a redirect 301 code to the www version of the page.

Hm, that's not right.

Post by **matthew1** » 05 Aug 2022, 13:12

FF31, can you try now?

https://matthewsvolvosite.com/forums/ucp.php?mode=login for instance

Post by **matthew1** » 05 Aug 2022, 13:26

My tests indicate my testing tools are still seeing a cert I just revoked, so it make take a few hours.

I found a cert for (matthewsvolvosite and www.matthewsvolvosite.com), and a separate cert for just www.matthewsvolvosite.com. That's obviously not the correct way to configure this, so I nuked the www.matthewsvolvosite.com cert, but tools and browsers I believe are still seeing it.

Note: just ignore that the forum software makes www.matthewsvolvosite.com a hyperlink and doesn't do the same for matthewsvolvosite.com. It's just a phpBB quirk.