Tweet
PHP and vBulletin generate a page request token that is supplied to the next page request as a header. It's the presence of this token that persists your login session, so that passwords are not transmitted every request.
If you navigate pages between ones that GET (most pages) and ones that POST (PMs, replies, search, login, etc), and reload, you can get the system to generate a different token but the browser may cache it from the prior page load. The next page request submits the incorrect token which then doesn't match what the DB is holding, and your login session is invalidated.
Also, some sites use a scheduled job to clean out session table ids every 15 minutes and if your inactivity is right on the edge it may be cleared.
If you navigate pages between ones that GET (most pages) and ones that POST (PMs, replies, search, login, etc), and reload, you can get the system to generate a different token but the browser may cache it from the prior page load. The next page request submits the incorrect token which then doesn't match what the DB is holding, and your login session is invalidated.
Also, some sites use a scheduled job to clean out session table ids every 15 minutes and if your inactivity is right on the edge it may be cleared.
Comment