Why am I having problems logging in and posting when my firewall is on?
Firewalls prevent unauthorised data being transferred from and to your computer. This effects data between applications connecting websites. Usually firewall users can "allow" permitted applications to transfer data and set various levels of security.
For example, XOOPS sites use the HTTP_REFERRER information to check if you're logged into the website. Some firewalls (most notably software firewalls such as Norton and ZoneAlarm) block this information being sent to the server. This could prevent you from logging into the XOOPS site. Typically this becomes evident when you log into the website, the login is confirmed, and you still see the 'login' box on the page, and you're not logged in at all.
The solution is to add the XOOPS site you're trying to log into to the Trusted Sites list of your firewall application.
For example, XOOPS sites use the HTTP_REFERRER information to check if you're logged into the website. Some firewalls (most notably software firewalls such as Norton and ZoneAlarm) block this information being sent to the server. This could prevent you from logging into the XOOPS site. Typically this becomes evident when you log into the website, the login is confirmed, and you still see the 'login' box on the page, and you're not logged in at all.
The solution is to add the XOOPS site you're trying to log into to the Trusted Sites list of your firewall application.
|
Re: More details...Login
Search
Who's Online
Donat-O-Meter
| Stats | |
| Goal: | $100.00 |
| Due Date: | Nov 30 |
| Gross Amount: | $0.00 |
| Net Balance: | $0.00 |
| Left to go: | $100.00 |
 |
|
Did you know ?
Random question
Recent Q&A List
- How to minimize Spam...
- Is there any chance to connect...
- How to download files from XOOPS...
- I'm making a module/theme and...
- How to properly configure your...
- How can i verify all of my files...
- I would like to know if it's...
- Can someone point me to the...
- Sense of XOOPS_TRUST_PATH
- I using the theme phpkaox, but...
T-tech posted this very helpful information in the forums on Aug 4 2004:
For security reasons, when you post a reply etc, the site checks that you have actually come from a page on the forum using what is called a HTTP_REFERER. This ensures that database entries can only come from the right page, and stops any external scripts (and would-be-if-they-could-be hackers)from entering info from souces OTHER than the forum reply page itself.
Unfortunately, some firewall and web filtering software, such as some versions of Zone Alarm, block HTTP_REFERER's by default.
# Disable WebWasher Standard Filter/URL Filter
# Disable any "ad blocking" software
# Disable any Pop-up blockers
----------------------------------------------------------
Zone Alarm Pro:
1. Click Privacy
2. Click Cookie Control
3. Click Custom
4. Uncheck "remove private header information"
----------------------------------------------------------
Windows XP's Internal Firewall
1. Open XP's Control Panel
2. Double-click Networking and Internet Connections
3. Select Network Connections
4. Right-click on the connection to disable, then select Properties
5. On the Advanced tab, clear the Protect my computer or network checkbox
6. Press OK
----------------------------------------------------------
Norton Internet Security 2002 (or earlier)
1. Open NIS or NPF.
2. Click Options.
3. Click Internet Security or Personal Firewall. (This step is not always needed.) The Options window appears.
4. Click Advanced Options.
5. Click the Web tab.
6. Click Add Site. A new site/domain box appears.
7. Enter http://www.88wp.com and click OK. The site name now appears in the left frame of the Advanced Options window.
8. Click the name of the new site.
9. Click the Privacy tab.
10. Check the "Use these rules for..." box.
11. Change the Referrer from "Block" to "Permit."
12. Click Apply, and then click OK.
13. Click OK to close the Options window.
----------------------------------------------------------
Norton Internet Security 2003/2004
1. Open NIS or NPF.
2. Do one of the following.
* In NIS/NPF 2003, click Options > Internet Security or Personal Firewall (This step is not always needed), and then click the Web Content tab.
* In NIS/NPF 2004, double-click Privacy Control, and then click Advanced.
3. Click Add Site. A new site/domain box appears.
4. Enter http://www.88wp.com and click OK. The site name now appears in the left frame of the Options window.
5. Click the name of the new site.
6. Click the Global Settings tab.
7. In the "Information about visited sites" section, clear "Use default settings."
8. Click Permit.
9. Click OK to close the Options window.
----------------------------------------------------------
Techincal Information about HTTP_REFERER's
(for the geeks who care)
When you click a Web page, your browser notes the current page that you are on and sends that information to the server of the new Web page. This way, the server for the new Web page knows the last Web page that you viewed.
For example, if you are on http://www.symantec.com and click http://www.microsoft.com , the browser sends http://www.microsoft.com the information that you are currently viewing http://www.symantec.com. If you block referrer information, the server of the page you are requesting to see does not know what page you saw last. By default, Norton Internet Security (NIS) and Norton Personal Firewall (NPF) block this information. Some Web sites require this information before they allow you to see their pages.
---------
I'll add that from a security perspective, if your modules are properly checking the validity of the variables they are receiving from the user, not relying on variables in the URL for sensitive info, etc, then your security issues are minimized. But there is no question that disabling the referrer check reduces the overall level of security on the site.
It's up to you how much of a compromise this is, given the modules you're using and how you're using them.
--Julian