Authorization code mismatch? PLEASE READ (FIX INCLUDED)

Authorization code mismatch? PLEASE READ (FIX INCLUDED) - Printable Version

+- MyBB Community Forums (https://community.mybb.com)
+-- Forum: 1.8 Support (https://community.mybb.com/forum-175.html)
+--- Forum: General Support (https://community.mybb.com/forum-176.html)
+--- Thread: Authorization code mismatch? PLEASE READ (FIX INCLUDED) (/thread-218862.html)

Authorization code mismatch? PLEASE READ (FIX INCLUDED) - Shade - 2018-07-24

MyBB 1.8.16 introduces some crucial changes aimed towards better security regarding users authentication. Templates containing login forms must be updated in order to comply with these changes; otherwise, you will stumble upon the following error:

Quote:Authorization code mismatch. Are you accessing this function correctly? Please go back and try again.

If you have upgraded to 1.8.16 or above, please read the following instructions carefully.

Templates requiring changes:

error_nopermission
header_welcomeblock_guest
member_login
portal_welcome_guesttext

You will need to apply the changes for these templates to each theme on your board.

Navigate to Admin CP -> Templates & Style -> Templates

Then for each template set go through the following process ensuring you do it for each of the templates in bold above:

For each template:
Either:

Select Options -> Revert to Original (but you will lose custom styling in this template); or
Open & edit the template and follow the rest of the steps
1. Locate the <form> tag
  Look through the template's code and find where the opening form tag is, for example:
```
<form method="post" action="{$mybb->settings['bburl']}/member.php">
```
2. Add the missing <input> element
  Add the following code after the <form> tag if it is not already there:
```
<input name="my_post_key" type="hidden" value="{$mybb->post_code}" />
```
3. Choose Save and Return to Listing
  Repeat the process for the other templates.

It's that simple. Your users will now be able to login again. my_post_key input is in fact now mandatory to be sent alongside other form parameters in order to protect your users and reduce potential malicious attacks.

The upgrade script will attempt to fix some templates that have not been customised from the "MyBB Master Style" and will handle the change automatically. This guide is aimed at all who have custom themes with these templates altered.

Still facing the issue?
If you have gone through the steps above, or the inputs are already in the correct place follow these additional steps.

If you are using a reverse proxy service, for example Cloudflare
Ensure that the IP of your visitors is being correctly set by either:

configure overwriting the REMOTE_ADDR variable in your webserver config using X-Forwarded-For or CF-Connecting-IP; or
enable the following setting: Admin CP -> Configuration -> Settings -> Server and Optimization Options -> Scrutinize User's IP address?

If you are running multiple boards on the same domain
Ensure you have different cookie prefixes for both boards to avoid any conflicts between them.

If you are using a cache solution between your board and visitor
Ensure that the cache for non-static assets is bypassed when the MyBB sid cookie is set, or only enable caching for static assets like .js, .png etc

RE: Authorization code mismatch? PLEASE READ (FIX INCLUDED) - Omar G. - 2020-10-24

Hi, if you are facing issues applying the required template edits mentioned above you can try the following plugin which tries to apply the edits for you upon activation.

https://community.mybb.com/thread-229579.html