Re: New details - one way to replicate

Posted by Hugo <Nabble> on Feb 15, 2009; 2:54am
URL: https://support.nabble.com/VERY-SERIOUS-replies-on-embedded-forums-attributed-to-wrong-accounts-tp2294190p2328533.html

Hi Steve,

Just an update. We have fixed several bugs in the last weeks and improved the login security. That case where a user was able to post as another user won't happen again. By the way, it probably happened because you posted a link to your forum with the cid information in it (links shouldn't have that information). The cid parameter is part of the Nabble solution to offer functional embeddable apps even when the browser has third-party cookies disabled. This goal is very difficult to achieve and most websites don't offer embeddable services because of this cookie challenge. Nabble is probably the only website that has gone that far and the details of this implementation are our best secret for now.

You can test your forum again and you shouldn't have problems with login. If you keep blocking third-party cookies in your browser, the login of an embedded forum (or gallery, blog, news, etc) is independent of the login on the Nabble website (we just can't read the cookies from another domain -- that's the challenge). So you must login on embedded forums even if you are already logged in on nabble.com. Another point is: if you play with multiple tabs on an embedded forum, you may eventually find a wrong login info on the top right corner (depending on the way you navigate), but this is harmless. If it happens, please just refresh your page (F5) and the login will be fixed. We are still working on a fix for that.

Regards,
Hugo Teixeira
Nabble.com