| Description | This is affecting both versions 3.22.19 and 4.2.7. It seems like I've been seeing this issue after LS v3.17.
I am getting several survey respondents who are getting either "your session has timed out" or "This token has already been used" when hitting Submit upon finishing their survey. The respondents say they are only in for anywhere between 1-30 minutes. According to our database, those tokens are successfully used and data recorded, but our respondents are angry that they believe their answers are not being recorded. We are not sure why this is happening.
FYI I have already tried changing the PHPSESSID cookie name.
I have two different installations in two different environments exhibiting the same problem:
SERVER 1 - on-prem:
Windows Server 2012 R2
Microsoft SQL Server 2016
IIS 8.5
PHP 7.3.4
SERVER 2 - Vultr cloud:
Ubuntu 20.04
Apache 2
PHP 7.4.5
MariaDB 10.3 |
|---|
| Steps To Reproduce | Not happening consistently at all. Was able to confirm with one respondent it happens on Safari / iOS 13.4, but most others do not get screenshot when they tell us it happens.
Error messages show up when hitting "Submit" on the last question. 50 / 50 "Your session has expired" / "This token has already been used". We have a screenshot of the latter. |
|---|
| Additional Information | This is with different surveys on two different systems, which is why this is so baffling. It happens on 1-question surveys and 8-question surveys. No redirect at the end / e-mail notifications at all. They are pretty basic surveys with tokens.
Here's my PHP settings, which are mostly out of the box.
session.cookie_lifetime = 0
session.gc_maxlifetime = 1440
It's very random and happens intermittently. It's perhaps less than 1% of the total respondents, but out of 150 or 2,000 respondents, that's still a good number of people. We weren't getting this issue before upgrading past 3.17, and I know there was a bug related to the cookie name for PHPSESSID, so I am at a loss. I did make that change in config.php:
'session' => array (
'sessionName' => "NAMESURVEY",
),
since I was getting this issue after upgrading from 3.x to 4.x, but now it's showing up in 3.22 also.
See https://forums.limesurvey.org/forum/installation-a-update-issues/121525-time-out-or-token-has-already-been-used-upon-submit#201007 |
|---|
