I recently ran into an issue that I was able to fix with what feels like a workaround – updating the config setting requireMatchingUserAgentForSession to
While I expect something changed on the website where I needed to do this, I'm not sure what would have changed and am curious if anybody with deeper knowledge of how user agents and sessions work could help explain what factors are at play here.
In my situation, members of the site were getting logged out shortly after they logged in and, while I could login to the control panel and navigate to several pages, each time I tried to access the Users tab, no users would display and I'd get logged out. Each time this happened the corresponding item in the logs referenced a discrepancy between the user agent in the cookie and the current user agent. The specific error message was:
Tried to restore session from the the identity cookie, but the saved user agent (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.109 Safari/537.36) does not match the current userAgent (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36).
The error outlines a discrepancy between
Chrome/48.0.2564.109 in the cookie vs the current
What scenario creates a discrepancy between the User Agent in the cookie and the current User Agent? What variables can change that cause a previously working membership site, to require suppressing differences in these variables to work? Does suppressing this required match and allowing for differences in the current User Agent and the session open up possibilities for other issues to arise?