Support

Admin Tools

#41119 Frontend user session / SU login

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
5.1.4
PHP version
8.3.11
Admin Tools version
7.6.1

Latest post by tampe125 on Monday, 16 September 2024 09:46 CDT

Monday, 16 September 2024 03:12 CDT

jjst135

Hi! I created an issue on the Joomla CMS GitHub because I think there is something wrong with the user sessions. I think the Shared session 'off' setting is ignored in the frontend. This got me thinking of the Akeeba Admin Tools option to disable frontend login for Super Users. If that function does not work would that also have the same effect? 

https://github.com/joomla/joomla-cms/issues/44062

The issue is: When I am logged in as SU in the backend, the frontend also sees me as logged in and this is not what happened before. (Not sure before what....).

Any thoughts on this?

 

Monday, 16 September 2024 04:27 CDT

jjst135

When I disable the Admin Tools plugin it did not change the issue.So this is most likely not an Admin Tools issue.

Monday, 16 September 2024 05:28 CDT

tampe125

Hello,

you're correct: if you disable Admin Tools and you still have the same issue, the problem is not indeed caused by Admin Tools. For some context, the way shared sessions works is by trying to set cookies for both the front- and backend applications when you log into either one.

However, there are several pitfalls in this approach and it won't work in many cases, e.g. when you have set a custom cookie path, or you're not using Joomla's database session storage option. Moreover, it can be a security issue, as someone logged in as a Super User in the frontend might be able to access the backend without being asked for further authentication (e.g. MFA, or secret URL parameter).

Honestly, considering all the above points, we do not suggest to use this feature.

Davide Tampellini

Developer and Support Staff

🇮🇹Italian: native 🇬🇧English: good • 🕐 My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Monday, 16 September 2024 05:41 CDT

jjst135

Hi Davide,

 

Thanks for getting back to me. I turns out the setting 'Shared session' (Off) was not stored correctly by Joomla. I needed to first turn is ON and save. And the turn it off again and save again. After that it worked as expected.

You suggest NOT disabling the Shared Sessions option in the global config? (We do this mainly because we don't want backend users to see all kinds of 'edit;  functions in the frontend....)

Or do you suggest not to enable the Admin Tools option to 'disable frontend login for Super Users'?

On our sites we have Shared Sessions OFF and frontend login for Super Users ON. Is this not a safe approach?

 

 

Monday, 16 September 2024 09:03 CDT

nicholas

You suggest NOT disabling the Shared Sessions option in the global config?

We suggest disabling shared sessions. It has security pitfalls.

Or do you suggest not to enable the Admin Tools option to 'disable frontend login for Super Users'?

We suggest enabling the “Disable frontend login for Super Users” option for your use case. As you said, you do not want backend users to be logged into the frontend.

On our sites we have Shared Sessions OFF and frontend login for Super Users ON. Is this not a safe approach?

This is a safe approach. It's also the exact opposite of what your initial post suggested you are trying to do – Davide and I both read it and understood the same thing. That's why I asked Davide to warn you about the security issues when shared sessions are enabled.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Monday, 16 September 2024 09:14 CDT

jjst135

We did not change the setting 'shared session' on our sites but somehow joomla decided to use it anyway on some sites. The fix was to first enable it (and safe the global config) ) and then disable it again, and save the config again. That solved the issue. So why this happened, who knows... I'm just glad we figured it out.

Sorry about the confusion. And thanks for your input!

 

Monday, 16 September 2024 09:46 CDT

tampe125

You're welcome!

Davide Tampellini

Developer and Support Staff

🇮🇹Italian: native 🇬🇧English: good • 🕐 My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!