New XKCD Forums

First off, thanks Snide Sniper for the new forum! So grateful <3

The 6 KiB limit on avatars is quite restrictive, as are the size ones - obviously you're hosting this yourself so I wouldn't demand that you change it, but do you think it would be possible to give us a bit more?

Oh jeez, is it really small? I kinda just left it at the default value. Lemme go change it real quick.

Oh yeah, this feels better.

Hmm, I'm having trouble uploading one that matches the new restrictions. Uploading one at the old size still works.

Is anyone else having issues where it logs you out after only a few seconds?

Well, I don't. I've been logged in for hours now.

I've gotten logged out at least once, maybe twice, even though I'm pretty sure I checked keep me logged in.

Same here. It won't keep me logged in. When I come back to the tab and refresh the page, I'm logged out.

I've found that I get logged out if I browse to the main page via URL (rather than the link at the top), but otherwise I stay logged in.

If you browse to any any subforum, thread, whatever else, theurl looks like this:
"https://ramenchef.net/nxf/posting.php?mode=reply&f=2&t=7&sid=8c997a7f9a161a993ef82d9b9ca19c26"

The "sid=" is the important part here.
After you successfully log in, the forum assigns you a random 128 digit number (32 hex digits), the SID.
The SID is then added to every forum URL presented to you by the server.
If you click the link your browser sends a GET request and the URL in that request includes the SID number.
If the server notices the correct SID number it will know that you are you, and that you are logged in.
(that's the only way how the server recognises people).

If you remove the SID from the URL and use the modified URL in the browser you will notice that you are no longer logged in.
(because the server didn't recognise that it was you)
But if you put the SID back, you will be logged in again.
If you put someone else's SID (which you don't have), you will be logged in as them instead.
(i think, but I did not check. There is a possibility that the server checks other things too. Maybe if correct SID comes from wrong IP it will be rejected? I don't know)
(also don't bother using the SID from my example, I generated a random number)

With this mechanism, when you log in,
as long as you click links on the pages,
you will continue being logged in.
But as soon as you go to a place here somehow else (from external link)
You will not be recognised any more.

This is not the only possible mechanism used by phpBB forums.
The SID doesn't have to be transmitted by URL.
The more common mechanism is doing it by cookie.

Cookie is the server's way of saying "remember this information for me, because I won't".
When the SID is stored in cookie,
then the browser will send it back to the server, regardless how it got there.
Then even if you followed an external link, you will still be recognised and continue being logged in.

For unknown reason this forum seems to not be using cookies.
I would like some cookie

I keep entering my old password...

Also some of the time avatars haven't been showing up for me (like, it just says "User avatar"). If I right-click and choose view image and then refresh a few times, some of the time it'll give me a "Not Found" page.

balthasar_s wrote: ↑Wed Aug 25, 2021 6:19 amThe "sid=" is the important part here.

Wait, so if I shared a link with the sid still in it, someone could end up logged in as me? (I haven't, but just checking.)

ratammer wrote: ↑Wed Aug 25, 2021 6:50 amWait, so if I shared a link with the sid still in it, someone could end up logged in as me? (I haven't, but just checking.)

Looks like the SID alone is not enough.
I copied the link to validator.w3.org and selected show html.
The page that validator received indicated being logged out, even though it contained my SID.

So the SID is required, but it is not enough.

ratammer wrote: ↑Wed Aug 25, 2021 5:21 am I've found that I get logged out if I browse to the main page via URL (rather than the link at the top), but otherwise I stay logged in.

I managed to get logged out by reloading the page after a long while.

Okay, I think I figured out what was wrong with the cookie settings. Should be fixed now.

It does seem to be working now - thanks!

It appears Google has found the forum.

And so it begins

I've just noticed that, if I'm the latest poster in a thread, I have the option to delete my post. That's probably fine in General and such, but in Forum Games it would be quite disruptive - is it possible for it to be disabled in that forum specifically?

How would it be disruptive?

The Snide Sniper wrote: ↑Tue Aug 31, 2021 4:27 pm How would it be disruptive?

Many of the games rely on how long it's been since the previous post was made. If it's possible to change that, it could mess with the scores. IIRC, deletion wasn't allowed in Forum Games in the old forum.

ratammer and somitomi are saying they can't access this forum right now

ratammer, on Discord wrote:I just get "this site can't be reached" as if it wasn't a real URL

ratammer, on Discord wrote:So like... not working in Europe or something?

somitomi, on Discord wrote:I just visited it using a free proxy to the US

Yeah, I'm having to access through a US proxy right now too. Looks like USians can access fine and Europeans can't - we don't have a sample of anyone else yet.

Ah, it's working now!

Must have been a problem with my host, because I certainly didn't touch anything.