Invalid Session key while taking a quiz

Invalid Session key while taking a quiz

by K P -
Number of replies: 5

Another issue that has suddently started since we returned to school in January is the sudden appearanc of an Invalid Sessionkey in the middle of a test.  Students will get randonly logged out and when they log back in and then choose the test, they can get all the way back through the "continue last attempt" screens and then the error pops up.  I was able to reproduce the error on my laptop by logging is as them, but today I had no issues while they still were.

 

We had 60 students testing and 7 encountered this error.  It seems though that if you wait for a random period of time, the student is able to get back into the quiz without that error, for some it is as simple as closing the browser, others even after logging out of the computer and then back in still the get error.  The last time it happened it took a couple of days before the error disappeared and I was able to log in as the student update the answers they had given me.

 

I have debugging turned on, but there isn't anything other than the error itself that is showing up.

 

I do have access to the database and have thought about deleting the session key but I am afraid this is clear out any answers they have already given.

Average of ratings: -
In reply to K P

Re: Invalid Session key while taking a quiz

by Tim Hunt -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers

The real problem is students getting randomly logged out. That is your root cause, and it is an issue with your authentication system that would be worth investigating.

Why do you get the 'Invalid session key' errors after the user has been logged in and out? Well, Sesskey is to do with security, it has nothing to do with where data is stored. I think you will only see that error if you get back to the "continue last attempt" screen (I assume we are talking about the page with url mod/quiz/view.php) by clicking the browser's back button. The page you get back to by clicking the back button is out-of-date once the user has been logged in and then out. If you click reload while looking at that page, then the Continue attempt button should work. Alternatively, get back to that page by clicking the quiz name in the Navigation bar, and all will be well.

Average of ratings: -
In reply to Tim Hunt

Re: Invalid Session key while taking a quiz

by K P -

Yes, I am talking about the continue last attempt screen.  refresh does not work.  closing the browser does not work, logging in and out of the computer does not work.   Waiting a bit sometimes works.  You mentioned clicking the quiz name, that does not work as well. 

Runthrough:

Student gets logged out.  They click the quiz name from the topic page.  They see the continue last attempt message.  They click continue.  The invalid sessionkey appears.  They log out of Moodle.  Close the browser and then reopen.  Log into Moodle.  Go to their course.  Click the quiz name from the topics listing.  Click continue last attempt.  Get the invalid sessionkey error.

 

Out of the 7 students who got this today, 2 were able to get back in after that process above.  4 couldn't and I printed their test for them to finish instead (didn't have time to troubleshoot)

The interesting thing is that when the logouts occur, they all occur at the same time.  The invalid session thing is a new issue.  I am monitoring the memory usage and it stays under 60%.

In December we used Moodle to distribute practice final exams and then gave the final exam on Moodle (we always use Moodle for testing).  We went on holiday for 2 weeks and these issues existed after we return.  Moodle was not upgraded at all during that time.  I applied latest update yesterday hoping that it might fix the issue, but it occured again today.   I did switch to Cloudflare for DNS service during the holiday break.  Joomla also started giving me invalid tokens on logins and as a result I switch back to my original DNS last week.  I have been off Cloudflare for about 5 days and all whois info is showing the DNS I am currently using (the one for my VPS provider.

I originally thought the logouts were a result of our internet connection and our proxy.  It does drop and that would explain the simulataneous nature of some of the issues. 

I do use a Joomla front end and Jfusion as a SSO for Moodle, but bypassing that and having them log directly into Moodle has the same issues for the invalid sessionkeys.

 

Average of ratings: -
In reply to K P

Re: Invalid Session key while taking a quiz

by K P -

Update:

You were right, the back button and then refresh worked.  I just assumed closing the browser would achieve the same as a refresh but it didn't

At least I know how to fix it during a test, but I do need to figure out why it is happening.

I current have sessions handled by my database.  Do you think disabling that and allowing it to write to disk instead would fix the isse?

Average of ratings: -
In reply to K P

Re: Invalid Session key while taking a quiz

by Tim Hunt -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers

That is a very clear description of what you are seeing. Thanks.

But it leaves me very confused, because sesskey does not work like that.

Some thoughts:

When you closed the browser, did you use Task manager (or equivalent) to make sure that the browser had actually quit, or might the problem still have been running with no open windows?

Might something be caching the Continue attempt page (including the wrong value of the sesskey in the form field)? That might also explain why refresh cleared it when closing the browser did not.

Well, these questions suggest the next experiment to try:

Using Firebug Net tab while working through the runthrough you give above, look at exactly what cookies are being sent to Moodle, and look in the HTML to see what value is in the <input type="hidden" name="sesskey" ...>. (It will be a random string. The key thing is, when does it change.)

Average of ratings: -
In reply to Tim Hunt

Re: Invalid Session key while taking a quiz

by K P -

No, I didn't check the processes, so it is possible IE was still running. 

Average of ratings: -