Customers unable to login after upgradeing to 1.3.9c

[RodG]

changed it to false... loged in ok
changed it back to true... loged in ok

tried 2 accounts...?

even tho this is off topic... what's the better setting for faster/safer site

session recreate: False or True?

Curious. With mine:
changed it to false... logged in ok
changed it back to true... redirect back to login page
changed back to false... logged in ok

I guess for the time being I'll be leaving this set to false.

Cheers
Rod

[Shane78]

out of curiosity... what are the pros to having recreate session set to true? and what difference does having this set to false?

[RodG]

out of curiosity... what are the pros to having recreate session set to true? and what difference does having this set to false?

From memory, recreating sessions helps prevent man in the middle type attacks.

Darn it... Now I've gotta go google it to satisfy my own curiosity..

Cheers
Rod

[gilby]

out of curiosity... what are the pros to having recreate session set to true? and what difference does having this set to false?

Setting to true stops customers getting the same session id from a posted link that includes a session id
It forces multiple users to get a new session id when they login

[neit]

So would it be best to leave this on if possible?

[RodG]

So would it be best to leave this on if possible?

Yes,

But if, like me, it causes a problem I wouldn't worry *too* much about having it turned off.
Yes, it does carry a risk, but the risk is no worse than it was before the recreate session function was made available (php4.3 or therabouts).

Cheers
Rod

[Shane78]

has anyone tried this in a new install of 139c?

i dont seem to be able to reproduce this, mind you my tests are limited? so there is still a chance this could happen to me

i have only tested on
1 clean 139c install
3 test site 139b to 139c upgrades
1 live site 139b to 139c upgrades

desktop MS Vista: IE, FF, Opera, Chrome
Lappy MS 7: IE, FF, Opera, Chrome
but both share the same tinterweb conection

[barco57]

I had it happen last night with a site I upgraded, login in firefox just looped me around to the home page with out an error and did not log me in. I tested on IE8, chrome, safari, and opera and could login fine.

[neit]

Strange I did the update this morning again and was able to login straightaway (tried it twice).
Still using firefox 3.6.3 with Recreate Session on.

[Shane78]

With the hardended zenners having this problem and not me, i thought i must have missed something...

i tried uploading my home made 139c upgrade pack this morning to zen-cart but the zipped files size was too large and it wouldnt let me... for people to see what i had missed out.

will see if i can get the time this afternoon to upload it to my webspace and post a link