Cloudflare Cookie Issue: CF_Authorization
Celso_Teixeira reported an issue where the expiration of the Cloudflare CF_Authorization cookie redirects users to a generic error page instead of showing a refresh pop-up page, as expected when the Discourse _t cookie expires.
Celso_Teixeira attempted to solve the issue by checking the cookie using JS, but it’s secure and inaccessible. The Cloudflare team also cannot extend the expiry date for security reasons.
pfaffman questioned the purpose of the Cloudflare authorization, suggesting that it might be unnecessary. Celso_Teixeira clarified that the CF_Authorization is not a Discourse cookie and triggers before the Discourse cookie _t.
pfaffman suggested changing persistent sessions or maximum session age, but Celso_Teixeira reported that it didn’t work. pfaffman recommended deleting existing cookies after changing settings, but Celso_Teixeira still encountered the issue.
pfaffman ultimately suggested doing without the Cloudflare cookie, as its purpose is unclear.
When the authorisation cookies expire (CF_Authorization) it redirects the user to a generic error page. Image bellow
The expected behaviour is to show the refresh pop-up page. that happens when the Discourse _t cookie expires. Image below.
Ideas that didn’t work:
Does anyone have an idea how can we solve this issue?
Other than breaking discourse, what problem is the cloudflare authorization solving?
I thought that there was a site setting for how long discourse cookies last, but maybe it’s hidden.
I’m not sure. The CF_Authorization is not a Discourse cookie. The problem is that the Cloudflare cookie triggers before the Discourse cookie _t.
You can try changing persistent sessions or maximum session age.
Why is the cloudflare cookie important?
I’m not sure. I will try to get more info on that.
I think you’d need to delete your existing cookies after changing those settings. They will affect only new sessions and be cookies.
Still not working. I open the forum in a Anonymous browser and after deleting the CF_Authorization cookie the same generic page was shown.
Oh, sorry. I guess I don’t understand what that cloudflare thing is doing. Can you do without it?
