Subject: Blog: User authentication

This is super boring stuff but here goes.

In the early days of the Internet it was fine to have a nickname and a password and just store 'em in the database.

But it's a much more security-conscious world now and it's considered really bad boogie to store passwords "in the clear" in the database. Not because a silly game login might be hacked but because a lot of people use the same passwords for silly game logins as they use for important stuff like financial information.

Also, these days we try to protect against somebody making a bunch of different nicknames like we allowed back in the early days.  I asked repeatedly for folks to stop abusing our rather forgiving policy and to avoid the political nicknames. But it was not to be. Folks kept creating nicknames like HillarySucksThis and TrumpSucksThat.  So finally I gritted my teeth and started enforcing one nick per email.  There were still ways to get around this of course but it shut down the flow.

But then requiring a confirmation email was too much friction for silly games and folks were just going to other sites where they didn't have to do the whole registration procedure.

So then I created a sort of semi-anonymous user where the username was randomly generated so folks couldn't poke in political stuff and I made those not require any authentication.  That helped quite a bit with the folks who just wanted to play the game without a lot of hassle.

And then folks were asking for the undo version of the game to come back but that can't be allowed in a competitive environment because folks could just hit undo until they got back to where they wanted to try different route. And then they'd never have to lose.

All of this added up to a fair amount of work for silly games so finally I broke off the user authentication mess into a separate service and now all my games will use that service.  That way I implement all this nuisance stuff once and then can get back to the fun part of doing the games.

So as of today we're using my new service www.gexhub.net to handle the user auth portion of things. I'd already moved Jezzball and Winnable Solitaire over and it seemed like it was behaving pretty well. This handles all that stuff alluded to above and if I need to fix something or enhance something, all the games benefit.

I'll be watching the Discussion Board for issues as I'm sure I've missed a few little things. But hopefully this will allow me to start work on some other games.  Stay tuned...

MrFixit

I actually read all of that!

It reminded me of Abraham Lincoln's famous quote that you cannot please all of the people all of the time!

It wasn't boring and it is informative. Not kissing up 🫥

It reminded me of Abraham Lincoln's famous quote  If you don't have anything good to say about someone come sit by me.

Ok..........I had read all that at the time, too, but I'm quite confused about how to 'use' it.  So one must now log-in via that web site??  And one can't change nicks????  The details about the procedure is lacking, if I may say so.

[Edit:  I was able to accomplish the task, as noted below.]

Seems like I can't edit the above post to inform that I *was* able to change nicks, but it sure was a roundabout pathway.

I planned to never log out, thus solving any problems I might have with this.

But though I am still logged on here on the desktop, as I have been for who knows how many years, looks like I am not logged in on the tablet.   I've never logged out there either.  I wonder what's different.

I'm afraid to reload the client.  I might never be logged in again.

I know how it used to work.  There were two senses of 'logged in'.  One, the existence of an entry in the server session table corresponding to you, that session info including the low level internet stuff like your ip address and whatever else it needs to know what device your client was running on.  And second, the existence of the credentials cookie in the browser running your client.  That made it all invisible, because if there was any mismatch in the session table the server and client would undertake to use the cookie to re-match, and log you in in the first sense while in the second sense, and from the user's viewpoint, you were logged in all along.

And maybe it still does work that way.  Maybe something I did on my tablet caused the cookie to vanish and I just have to log in - with no cookie that means being prompted for username and password.  But it seems too coincidental that Denny fooled with logins and my cookie disappeared.  I'm hoping I don't have to respond to username/password screen every time I switch devices.  That would be a negative experience.

What happened to my original username? Which is ekg.

<Omitted>

Joeygray I play on a tablet and a couple times found myself logged out, even though I never log out. I didn't have to log back in. All I did was proceed on, and I was magically logged in.

I using “localstorage” now instead of a cookie. Subtly different. What browser?

Hmmm.  I'm logged in enough to play (and lose, thank you velly much) a game.  But the discussion page says I'm not logged in.  And the scores page doesn't pre-fill my user name.  I re-loaded both of those but it didn't fix it.

Guess I better try logging out and back in again.

...

Logging out didn't work, saying I was not logged in.  Odd.  I wonder how I was able to play?

...

But logging back in did work.  I guess.

Happened to me 2 days ago, but cleared up 

https://www.freecell.net/f/c/disctopic.html?code=18307&replies=3#idlast

I use Edge. From your home page, hitting login or play will log me in automatically and send me to play page. If I go directly to discussion page I cannot post unless I do one of the above. If I want to change user, I need to do the same in order to log out. Logging out is the only way you see the id/password prompt on next login. 

Huh. Maybe you have tracking prevention on "strict"?

Got to 3 dots upper right, scroll down to "Settings" -> Privacy -> Tracking prevention.

Any settings you've changed from default?

MrFixit

Everything's default. This is with a clean browser. If I don't close, then I can close the tab and reopen and I'm still logged in. It's not a problem. 

Again my discussion board tab became convinced I wasn’t logged in, despite my not logging out (as I never do.)  Had to x out of that tab and then reload it from the main page.  What causes this?

Also, is there a point to making us hit ‘ok’ when the server must re-do the login?  If so I don’t see it.

Hi, what happened to outskirts also happened to me a couple times in the last week. I use safari or chrome. Usually safari. Didn’t report anything since I got in. But was odd. “ I play on a tablet and a couple times found myself logged out, even though I never log out. I didn't have to log back in. All I did was proceed on, and I was magically logged in.” 

Yes, I think that is correct expected behavior. I require you to re-auth every day or so and that should do so automatically. It used to be 16 minutes, then I went to "infinite" and how I'm back at one day.

MrFixit

Not really the same.  Previously you could always stay logged in, 100% of the time.  The discussion board would always have you logged in with your username.  (It was better when you could actually type the username and password, but that I guess is a dead horse at this point.)  You didn't have to have a session to post, nor have a session to have your scores page auto-prefilled with your username.  And if you wanted to play, and the server decided for whatever reason to reauthorize you, it just did, without that extra 'ok' you have to hit now.  And btw, I often have to go through it twice to get back to playable state, don't know why.  Just another thing to get used to, that didn't need fixing.

All this to make sure everybody sees the MOTD every single day.  When it would have been better to have this behaviour only when you have a manual MOTD that everyone NEEDS to see. 

Edit:

BTW, I had high praise for when you first introduced 'infinite session' about a year ago now. Just in case you're thinking I'm nothing but whining. :)

Yeah I thought about that having it only time out the session when there's a non-automated MOTF. Maybe I'll put it back to infinite. I only wanted my explicit messages to be seen when I was doing the user auth cutover but that seems to be behind us now.

MrFixit

Yay! 

Do not attempt to adjust your horizontal, do not adjust your vertical.

I am unable to log in with my username  gerber  and current password. The username becomes underlined in red and the change password button does not respond.

I use an iPad. This happens both on Safari and chrome.

Do you have any suggestions on what the problem is and how I can fix it?

Password reset is not working for you. I’m traveling so gimme a day or 2 to see what’s up. And let’s keep it on the other thread.

MrFixit