Showing me logged in as other people

[Chris]

I had this happen on mobile a minute ago and now seeing it on web, it's showing me as logged in as other users.



It's happened with a few different users, not just Danceswithhelicopters. When I go to my profile it goes to the correct profile, but something funky seems to be happening with auth tokens.

 

[TeeDee]

I'm getting this - I'm literally made up...

 

[Chris]

Our very own BCUK Freaky Friday!

 

[Kepis]

Just keeps asking me to log in, then when i click Log In, it comes up as "You are already logged in"

 

[Pattree]

Is this a BcUK thing or Tappatalk?

ETA. I’m not on the app and all is well here.

 

[oldtimer]

Just keeps asking me to log in, then when i click Log In, it comes up as "You are already logged in"

Me too

 

[Chris]

Is this a BcUK thing or Tappatalk?

ETA. I’m not on the app and all is well here.

I have never used Tappatalk and it's happening on web and mobile, it's the site itself.

 

[Kadushu]

Looks like a Highlander situation. Swords out! There can be only one!

 

[Herman30]

Just keeps asking me to log in, then when i click Log In, it comes up as "You are already logged in"

Me too this.

 

[TeeDee]

Getting weirder..

 

[TeeDee]

I've also noticed people that were on my Ignore list have in someways suddenly reappeared , a bit like this fellow

 

[TeeDee]

I feel like an episode of Quantum Leap.

 

[Pattree]

Now. The header that @TeeDee is showing is different from mine. Is Iphone different layout from Android.

It looks as if I’m stuck with being me!!!

 

[Chris]

Now. The header that @TeeDee is showing is different from mine. Is Iphone different layout from Android.

It looks as if I’m stuck with being me!!!

Looks like it’s a screenshot from a PC to me!

 

[TeeDee]

Looks like it’s a screenshot from a PC to me!

Yes screen shot from PC - Its just been jumping around to several different people ( assume this it the same for everyone ) - also Notification bells are showing but when I go to the notification to read it - it doesn't 'clear; the notification bell -it remains there.

Just saying as feedback - 1st world issues , no massive headaches - just weird..

 

[Tony]

Thanks for raising this, were looking into it.
For clarity, is it only the usernames that are getting messed up? No one is actually being logged in as anyone else?

And, its only happening when you log in on some pages (like the home page of the forums) and not all pages?

Thanks

 

[Chris]

From this screenshot from TeeDee it looks like at least partially permissions are also being applied (see banner at the top of his screenshot).

I'm getting this - I'm literally made up...

View attachment 97853

It seems to only apply for that single page load, as when you click elsewhere it seems to log you back in as yourself. But the fact it is allowing it at all is a concern, as someone malicious with a bit of effort may be able to abuse this by manually replicating the erroneous authentication consistently and therefore persistently logging in with someone else’s permissions to cause mischief (or worse if they catch an admin’s session credentials).

It’s happened to me on a few pages.

Interestingly it has twice happened where I go to read a private message from someone, then when I navigate away from the inbox it shows me logged in as that specific person. Has happened with two different people who DMed me.

 

[Tony]

Thanks for the information

 

[Tony]

Can you all try again and let me know if its still happening, I can't replicate it but were hoping we've fixed it

 

[TeeDee]

Can you all try again and let me know if its still happening, I can't replicate it but were hoping we've fixed it

No weirdness so far.