NetTalk Central

NetTalk Web Server => Web Server - Ask For Help => Topic started by: Alberto on May 23, 2020, 03:10:26 AM

Title: Bad Session ID (Host Changed)
Post by: Alberto on May 23, 2020, 03:10:26 AM
Using Chrome, accessing my NT server locally using 192.168.x.x I ask a payment service using my external IP 200.x.x.x, then the payment service returns to 200.x.x.x/paymentresponse page , the page was served but shown as it has no css
Then I try to conect to the server using 200.x.x.x and I got this error 403
THis is the source code of the page.

Code: [Select]
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html class="no-js">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" /><link href="/styles/error.css" rel="stylesheet" type="text/css" /><title>403 </title></head>
<body class="ErrorPage">
<div class="ErrorDiv">
<hr></hr>
<h1></h1>
Bad Session ID (Host Changed)
<br><br><hr></hr>
</div></body>
</html>

I press Ctrl-F5, exit the server an run it again, exit chrome and run it again and I always reach this error page
How to back it to normal?
Title: Re: Bad Session ID (Host Changed)
Post by: Bruce on May 23, 2020, 10:59:45 PM
It's a security condition that prevents some session fixation attacks.

>> accessing my NT server locally using 192.168.x.x I ask a payment service using my external IP 200.x.x.x, then the payment service returns to 200.x.x.x/paymentresponse page

This sort of routing is not allowed. The session cannot be linked to 2 different hosts ( 192.168.x.x and 200.x.x.)

Cheers
Bruce
Title: Re: Bad Session ID (Host Changed)
Post by: ntnewbies on May 28, 2020, 06:09:30 AM
i get bad session id today after i change performance to debug...
when i change it to web and re run gzip for both script n style, the error vanishes.

jason
nt 11.36
c11
Title: Re: Bad Session ID (Host Changed)
Post by: Bruce on May 31, 2020, 12:06:02 AM
Hi Jason,
that seems unrelated to Alberto's question, so I recommend you start a new thread and include all the relevant information - like any messages in the browser console, what you are going when you get the error, and so on...

cheers
Bruce