Login and Logout Errors from Cache Settings Conflict with Cloudflare

Dear Community Members,

I am reaching out for help with a critical issue affecting our Discourse forum at starorigin.net. Users are experiencing a severe login/logout bug that is paralyzing our community. When attempting to log out, the page refreshes but fails to fully log out, displaying a message “You have been logged out” with a refresh button that doesn’t resolve the issue. Additionally, logging in or out in new browsers or incognito mode is problematic.

We have tried several troubleshooting steps, including clearing browser cache, using different browsers and devices, and checking for updates. We suspect that recently installed plugins and themes might be causing the issue, but even after removing them and rebuilding the container, the problem persists.

Your expertise and assistance are greatly appreciated. Please respond with any insights or solutions you might have.

Thank you for your help.

This issue has been resolved.
Thank you all for your support and suggestions, especially @denvergeeks, who enthusiastically helped me by registering and logging into my website to pinpoint the error and resolve the issue. Half of this problem was due to my own oversight and foolishness, as there was a conflict between Cloudflare’s cache settings and the cache settings of my server management panel, 1Panel. After I turned off the cache switch in the 1Panel server management panel, my website returned to normal. I am very grateful to everyone for your help!

Just wondering, does it happen in safe mode?

1 Like

safe mode, this bug is still severely present. Additionally, when I log out of my administrator account, I am automatically redirected to a regular user’s account, and a window appears saying “You have been logged out.” Furthermore, I migrated to a new server a few days ago, and I am unsure if this is related.

1 Like

After registering on your site and then signing out, here are my screenshots.

Reloading the page after logging out just continues to result in the same messages while I can still see my avatar there in the header.



After several minutes (after logging out) I reloaded the page again and this time I seem to be logged out.

So then I tried logging in again, and after that I still see the Login button…

Several minutes later I reload the page again but no change I am still not logged in.

I switch to Desktop mode (I am doing all this in Chrome on iPhone 13 Pro) and here is the screenshot…

Now several minutes later I tried again to Login but cannot login and continue to see the saw as the last screenshot.

2 Likes

This is exactly the issue I’m currently facing! Just now, when I tried to log into my account, I was even mistakenly redirected to your account interface! I have no idea what is causing all of this. I plan to back up my community data, delete the containers, pull the images again, rebuild the containers, and restore the backup to see if that resolves my problem.

2 Likes

That’s kinda spooky!

What are you seeing in the browser developer tools console?

2 Likes

Is this on a supported install, set up using our official installation at discourse/docs/INSTALL.md at main · discourse/discourse · GitHub?

2 Likes

When I tried to log in to my account, the browser’s developer mode reported an error:

Mixed Content: The page at ‘如何在手机app上方便地登录本社区? - 慢聊时光 - 星语思源’ was loaded over HTTPS, but requested an insecure font ‘http://starorigin.net/fonts/Lora-Bold.ttf?v=0.0.12’. This request has been blocked; the content must be served over HTTPS.
chunk.ea1861026282343f4c7d.d41d8cd9.js:1

When I attempted to log out of my account, an error was also reported:

Mixed Content: The page at ‘https://starorigin.net/’ was loaded over HTTPS, but requested an insecure image ‘http://starorigin.net/uploads/default/original/1X/c9eda24b3c8cae88b2287cd3d700e7a3c1eaa87d.svg’. This request has been blocked; the content must be served over HTTPS.
starorigin.net/:1 Mixed Content: The page at ‘https://starorigin.net/’ was loaded over HTTPS, but requested an insecure element ‘http://starorigin.net/uploads/default/optimized/1X/e5b35745d255cb00fd1111ac078d95a13229adc6_2_512x512.png’. This request was automatically upgraded to HTTPS. For more information, see Chromium Blog: No More Mixed Messages About HTTPS.

Chrome browser provided a suggestion, but I don’t quite understand what it means:

Mixed content: load all resources via HTTPS to improve the security of your site.
Even though the initial HTML page is loaded over a secure HTTPS connection, some resources like images, stylesheets, or scripts are being accessed over an insecure HTTP connection. Usage of insecure resources is restricted to strengthen the security of your entire site.

To resolve this issue, load all resources over a secure HTTPS connection.

Now on my Windows 11 desktop (also in Chrome)…

I logged in to your site again, and first see this (logged in, but someone else’s account)…

Then refresh a few more times and see this… (again, logged in, but in someone else’s account)…

There are many topics about mixed content errors.

Here’s one solution:

But there must be a reason some content isn’t loaded through HTTPS, as it should be the default with a standard install.

A few days ago, I migrated to a new server. Here’s how I did it: I followed the official steps to pull the image, create the container, and enter the container. Then, I created an app.yml file and copied the contents of the app.yml file from my old server to the new one. After that, I uploaded my community backup data to the default backup directory on the new server. Finally, I rebuilt the container. Following these steps, I successfully migrated to the new server. However, one day later, after attempting to install new plugins, I encountered this bug. I removed all the newly installed plugins, but the bug still persists, and I am unable to resolve it.

After a few more minutes, your site refreshed itself and then I see this in the console…

I refresh the page once again and then see this (those errors now disappeared)…

Just a few minutes ago, I followed the advice from the friend in the post above and forcibly enabled HTTPS.

My console just reported an error:

[PLUGIN discourse-tooltips]
“Deprecation notice: Modifying topic-list with reopen is deprecated. Use the value transformer topic-list-columns and other new topic-list plugin APIs instead. [deprecated since Discourse v3.4.0.beta3-dev] [deprecation id: discourse.hbr-topic-list-overrides]”
I wonder if this is related to this plugin?

It seems I might have figured out where the issue is. This plugin appears to have been deprecated, so I’ll try removing it and see what happens.

I don’t believe so, that’s just a developer awareness deprecation warning for an api it is using, that is now deprecated. It is not an error. That specific API will not be removed until Q2.

1 Like

Interesting… Just now I freshly opened your site (but did not Login) in Firefox (which I have never used yet to go to your site, or even at all this morning), and even without logging in I see there that I am logged in as that same other user…

Then, a few minutes later the page refreshed itself again and it shows as logged out…

Then, I see these errors in the Firefox browser console…

And then following another refresh, these…

In Brave browser I see this…

Could this discussion be related:

2 Likes

Yes, as you mentioned, this is not an issue with the plugin. I still cannot pinpoint and resolve this problem at the moment.

I tried logging in again (using Brave) and got this (I see I am logged in with my correct user avatar)…

But then after I refresh the page again I am logged out…

I also go to the User listing page and see that I am not listed there as a user…

Then refresh the page again and I see my user as logged in again…

Then immediately I click to go to the User listing page, but I am still not listed as a user (even though I can still see my correct avatar in the header)…