Login form no longer lets me login to my site

[swisspenelope]

Hi

I am creator/adminstrator of a site using Simple WordPress Membership plus Form Builder and Directory. I have up-to-date versions of everything – WordPress core plus all plugins.

I’ve recently had some serious problems with Form Builder, but their “premium support” suddenly stopped answering my questions altogether, and I had to solve my these major issues single-handedly.

At the same time as all that was happening, but preceding the Form Builder problem, I was getting the recurrent – but not regular – problem of sometimes not being able to log in via the frontend SWPM Login Form button. This started happening a few months ago and has happened about five times now. I’ve tried changing my password, and although the Change Password procedure works, the same thing happens – I try to log in, and either I get the Session Expired message again and again, or the password I typed just disappears from the Password field, i.e. it refuses to accept it.

Logging in with native WordPress URL works – but only for access to wp-admin area.
At first, I go to my website, but when I try to login, the login form keeps replying with “Session Expired” again and again. If I use the link https://my_site/wp-admin, it DOES let me in to the WordPress admin area, but once I go back to the frontend of the site and try to access protected areas (protected by SWPM), it once again displays the login page and says I have to be logged in … But I am already logged in.

At some point, around 10 minutes after this nonsense starts, the problem seems to solve itself.

Can you explain what’s going on here?
Thanks
swissp

[The Assurer]

Are you using any caching plugins on your site? And is this issue consistently reproducible?

[swisspenelope]

Hi Assurer,

No, I do not use ANY cache plugins, and from a long career in development, I have the habit of clearing browser cache every few minutes, just in case.

I *WISH* the issue were reproducible in a consistent way, because then I could give you a bug report detailing the exact steps I took. My best guess as to the sequence of events is the following:

Normally, I log in via SWPM Login button, do whatever checks I need to do at the frontend, do whatever maintenance I have to do in the Admin panel, and then close the site. The next few times I return to the site, it does not ask for a Login again, but gives me access to the protected frontend and Admin panel without asking for new authentication. This suits me well.

New behaviour as of a few months ago:
1
Every few days (or weeks), I return to my site, but when I try to access protected feature in the frontend, SWPM displays the login form, with “Session Expired” at the bottom.
2
So I enter my email address (username) and my password, it *appears to accept that*, but
3
when I click on a protected feature again, I get the line “You have to login to use this feature. Not a member? Join us!”
4
If I am foolish enough to try and enter username and pwd again, the same thing happens again and again. I go round and round, logging in, then being told I have to log in.

At some point I don’t even get beyond Step 2, because instead of accepting my credentials, it just erases my password and “Session Expired” appears.

When I get worried and start looking for other solutions, I type the native WP url
https://my-site/wp-admin, which gives me the WP login window, and with THAT I can log in to the Admin area and do things in there, BUT any attempt to access something protected in the frontend starts the list of steps above.

Please bear in mind that I have 500 subscribed members on this site and I can’t just start debugging in Production, de-activating plugins until something works again!

I have been wondering if new, improved security has been added to the SWPM code, that forces a “Session Expire” every (n) logins? This never used to happen. For many years I was using SWMP and there was never an unexpected forced logout behind the scenes. But I have too many customers now and no time any more to look into the code and see what it is doing.

Thanks in advance
swissp

[The Assurer]

Every few days (or weeks), I return to my site, but when I try to access protected feature in the frontend, SWPM displays the login form, with “Session Expired” at the bottom.

Is your browser accepting cookies, from the site?

I have been wondering if new, improved security has been added to the SWPM code, that forces a “Session Expire” every (n) logins?

All changes to the plugin are listed here:
https://wordpress.org/plugins/simple-membership/#developers

[swisspenelope]

Thanks, Assurer.

I do allow cookies of course, but in Chrome “third-party” cookies were blocked and there is a Do not track directive. But I checked the presence of cookies in Chrome and Firefox and found some WordPress and SWM cookies, including swpm_session_in_use, so that appears to be fine.

[Author]

Posts