Describe the issue or problem
After running smoothly for a year, our OJS platform has been displaying an HTTP 500 error since the day before yesterday, which has left the site completely offline. The only error messages appearing in the Apache log are as follows:
BTW, I think it’s safe to update the OJS system to the minor builds . Take a look at this upgrade demo+guide at https://www.youtube.com/watch?v=p0f29tMofik which explain the benefit to minor build updates and how to do it . Also take a look at the official upgrade doc .
Thanks a lot for the clarification and the resources! I really appreciate the guidance. I’ll get in touch with our webmaster to proceed with updating the OJS system to the latest minor build.
@cendocu sorry my last comment did not contain full possible solution so I have deleted it .
I have a theory about where it went wrong and what can fix it (unable to test it as unable to produce the problem itself in my 3.4 installation) , So need 2 file edit to test the theory as
Hi, I tested your proposed solution, but unfortunately it did not resolve the login loop issue. The website itself is up and running; however, we are still unable to access the dashboard. This situation is becoming quite frustrating, as we have been unable to log in for the past two weeks.
I would greatly appreciate any further guidance or support you can provide.
Hi @cendocu , this is really frustrating. can you take a look at the error log and see if there is anything new getting logged as due to login loop . In the mean time I will try to re-produce this issue in my local installation to see where the real problem is happening
Hi, I’ve checked the error log, but nothing new is being recorded related to the login loop. It doesn’t seem like any errors are being logged at the moment.
are you guys running behind a reverse proxy and does it change the IP at every request ? if that is the case , perhaps try to set the session_check_ip to Off in the config.inc.php to see what happens
are there multiple hosts set up for the config allowed_hosts in the config.inc.php ?
Also is the allowed_hosts set properly ?
it feels to me that this probably not a session related issue anymore as the last code recommendation (change in 2 files) should fix it . But as I can not re-produce it in my local installation, very hard for me to confirm that real root cause .
We are not running behind a reverse proxy. The session_check_ip setting has always been set to Off. Additionally, we have only a single host defined in the allowed_hosts configuration, and it is set correctly.
///////////////
Additionally, after upgrading from version 3.4.0-5 to 3.4.0-10, the Web Feed plugin started redirecting to pages that return a 500 Internal Server Error
I think you have installed a wrong version of webfeed plugin which is not compatible with 3.4.0-x . The line undefined method PKP\userGroup\UserGroup::withContextIds points to the version compatible with OJS 3.5.0-x as this changes has been introduced in 3.5 version .
is this login loop happening for every single users ?
if this only happening for you or specific users, can you try to login from a different browser or in browser’s fresh incognito/private mode and see what happens ?
When testing the above No : 2, first try it without the code change the I previously asked to tests.
About the issue with webfeed plugin, it seems we bundled a wrong version of webfeed with the 3.4.0-10. Looking into it and hopefully will update the release very soon . Until then, disabling the plugin is the right choice .
I tried to register and login and seems can register properly (with account verify also) but trying to login with right creds does not login and redirect back to https://eco.mdp.edu.ar/revistas/index.php/faces/index . No login loop .
When checking the response headers, I noticed as following
There are TWO conflicting cache-controlheaders. OJS sets no-store (don’t cache this), but something — almost feels like Apache’s mod_expires — is adding max-age=2592000 (cache for 30 days).
The max-age=2592000 being exactly 30 days matches OJS’s default session_lifetime = 30. But this header shouldn’t be on dynamic page responses. I suspect it’s a server misconfiguration that may have existed for a while but only became visible when the session errors started (before, the cache was periodically refreshed; now, stale cached pages are stuck).
please check Apache config — look for ExpiresDefault or mod_expires as something related to ExpiresActive like
ExpiresActive On
ExpiresDefault "access plus 30 days"
or mod_headers has something Header set Cache-Control "max-age=2592000"
Alternatively check if there is any .htaccess set and if so see adding following can help
<FilesMatch "\.php$">
ExpiresActive Off
Header set Cache-Control "no-store, no-cache, must-revalidate"
</FilesMatch>