adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-10-31 01:32:02 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

Webadmin 403 After Login #445

New Issue
Closed
opened 2026-10-05 04:21:17 +02:00 by adam · 11 comments
adam commented 2026-10-05 04:21:17 +02:00
Owner
Copy link
Copy source

I've setup webadmin for znc; everything works as aspected. But I didn't hit that logout button after I used the panel.
Now my ip has cycled (by the provider every 24h) and when I try to login in now it returns a 403 error: This session does not belong to your IP.

Is there an easy way to gain back access to the account, without restarting znc?

Cheers,

Christian

P.S.

I know that this is a security feature, and you can turn it off; however if a user provides the correct username and password, why should znc lock the user out, when connecting from another IP? I mean if the attacker has the password, he could connect via IRC as well... Not sure if this lockout is bug or feature...

I've setup webadmin for znc; everything works as aspected. But I didn't hit that logout button after I used the panel. Now my ip has cycled (by the provider every 24h) and when I try to login in now it returns a 403 error: **This session does not belong to your IP.** Is there an easy way to gain back access to the account, without restarting znc? Cheers, Christian P.S. I know that this is a security feature, and you can turn it off; however if a user provides the correct username and password, why should znc lock the user out, when connecting from another IP? I mean if the attacker has the password, he could connect via IRC as well... Not sure if this lockout is bug or feature... <!-- github-sync-id:53355315 -->
adam closed this issue 2026-10-05 04:21:18 +02:00
adam commented 2026-10-05 04:21:18 +02:00
Author
Owner
Copy link
Copy source

Have you set a value in Allowed IP's?

Have you set a value in Allowed IP's? <!-- github-comment-id:68658336 -->
adam commented 2026-10-05 04:21:19 +02:00
Author
Owner
Copy link
Copy source

No, all IPs are allowed. (Wildcard)

No, all IPs are allowed. (Wildcard) <!-- github-comment-id:68702556 -->
adam commented 2026-10-05 04:21:20 +02:00
Author
Owner
Copy link
Copy source

Normally refreshing the page will then log you out and your free to log in?

Normally refreshing the page will then log you out and your free to log in? <!-- github-comment-id:68705182 -->
adam commented 2026-10-05 04:21:21 +02:00
Author
Owner
Copy link
Copy source

Mhh, ok I thing I've found the problem...
When logging in with another computer it doesn't work, but with the same it works perfectly.
Seems like a bug to me anyway... Why should you just be able to be logged in from one computer...

I switch from Desktop to Laptop quite often...

Mhh, ok I thing I've found the problem... When logging in with another computer it doesn't work, but with the same it works perfectly. Seems like a bug to me anyway... Why should you just be able to be logged in from one computer... I switch from Desktop to Laptop quite often... <!-- github-comment-id:68705407 -->
adam commented 2026-10-05 04:21:21 +02:00
Author
Owner
Copy link
Copy source

There's no such restriction. Do you somehow share cookies between computers?

2015-01-05 13:10 GMT+00:00 Christian Gärtner notifications@github.com:

Mhh, ok I thing I've found the problem...
When logging in with another computer it doesn't work, but with the same
it works perfectly.
Seems like a bug to me anyway... Why should you just be able to be logged
in from one computer...

I switch from Desktop to Laptop quite often...

—
Reply to this email directly or view it on GitHub
https://github.com/znc/znc/issues/805#issuecomment-68705407.

There's no such restriction. Do you somehow share cookies between computers? 2015-01-05 13:10 GMT+00:00 Christian Gärtner notifications@github.com: > Mhh, ok I thing I've found the problem... > When logging in with another computer it doesn't work, but with the same > it works perfectly. > Seems like a bug to me anyway... Why should you just be able to be logged > in from one computer... > > I switch from Desktop to Laptop quite often... > > — > Reply to this email directly or view it on GitHub > https://github.com/znc/znc/issues/805#issuecomment-68705407. <!-- github-comment-id:68706062 -->
adam commented 2026-10-05 04:21:22 +02:00
Author
Owner
Copy link
Copy source

No, I'm sure that Chrome doesn't share them between devices.

No, I'm sure that Chrome doesn't share them between devices. <!-- github-comment-id:68706228 -->
adam commented 2026-10-05 04:21:23 +02:00
Author
Owner
Copy link
Copy source

Is there an easy way to gain back access to the account, without restarting znc?

Can you access ZNC using IRC client? /msg *status saveconfig, change ProtectWebSessions = true to ProtectWebSessions = false in ~/.znc/configs/znc.conf (you might want to take backup of this file and ensure that you change nothing else than this line) and then /msg *status rehash

This is just workaround and I am not sure if I would recommend this.

> Is there an easy way to gain back access to the account, without restarting znc? Can you access ZNC using IRC client? `/msg *status saveconfig`, change `ProtectWebSessions = true` to `ProtectWebSessions = false` in `~/.znc/configs/znc.conf` (you might want to take backup of this file and ensure that you change nothing else than this line) and then `/msg *status rehash` This is just workaround and I am not sure if I would recommend this. <!-- github-comment-id:68706884 -->
adam commented 2026-10-05 04:21:23 +02:00
Author
Owner
Copy link
Copy source

I've got access already back, by logging in from my desktop computer.

But I think it is a bit annoying to always log out, if I want to switch computers.

I've got access already back, by logging in from my desktop computer. But I think it is a bit annoying to always log out, if I want to switch computers. <!-- github-comment-id:68707010 -->
adam commented 2026-10-05 04:21:24 +02:00
Author
Owner
Copy link
Copy source

The same option is also in webadmin global settings (Protect Web Sessions: Disallow IP changing during each web session.)

The same option is also in webadmin global settings (`Protect Web Sessions: Disallow IP changing during each web session`.) <!-- github-comment-id:68707313 -->
adam commented 2026-10-05 04:21:25 +02:00
Author
Owner
Copy link
Copy source

Ok thanks.

Ok thanks. <!-- github-comment-id:68707556 -->
adam commented 2026-10-05 04:21:25 +02:00
Author
Owner
Copy link
Copy source

Logout on one computer doesn't affect another computer at all (unless for very unfortunate reason random cookies happened to be the same string)

One reason for error "This session does not belong to your IP" can be that if you have IPv4 and IPv6, browsers can try both of them, and therefore sometimes connect via IPv4, and sometimes via IPv6, which looks like different addresses to ZNC, triggering the protection. See #241

Logout on one computer doesn't affect another computer at all (unless for very unfortunate reason random cookies happened to be the same string) One reason for error "This session does not belong to your IP" can be that if you have IPv4 and IPv6, browsers can try both of them, and therefore sometimes connect via IPv4, and sometimes via IPv6, which looks like different addresses to ZNC, triggering the protection. See #241 <!-- github-comment-id:68775004 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#445