Chapter 3 of 6 / I cannot get in
I log in and get thrown straight out
The login succeeds, a page flashes, and you are back at the form. Most of the time this is the session rather than the account, and there is one variant that is not, so it is worth telling them apart quickly.
What it usually turns out to be
| Cause | How often | What settles it |
|---|---|---|
| Cookies being blocked or cleared | Very common | A session needs one. Check the browser is keeping it |
| The circuit changing mid session | Common | Some sites tie a session loosely to the route |
| A stale session from a previous visit | Common | Clear the site data and log in once |
| Load on the far side dropping sessions | Occasional | Try later |
| Somebody else logging in and displacing you | Uncommon and serious | See below, and act now rather than reading on |
Telling the harmless case from the serious one
| What you notice | What it points at |
|---|---|
| It happens on the first login of the day | Session handling. Dull |
| It happens every time, at every address | Browser settings. Still dull |
| It started after you used a link somebody sent | Check the address before doing anything else |
| It happens repeatedly and only sometimes | Worth treating as the serious case until shown otherwise |
| Messages you did not send are in your outbox | Not this page. Go to the aftermath chapter |
The order to check things in
If you have any reason to think somebody else is in the account, read the message log before you look at the balance. A taken account is worth more as a way to talk to people who already trust it than as a balance to drain, and the messages tell you whether you have become the source of somebody else problem.
The dull fixes, in order
- Clear the site data for that address and log in once, not repeatedly.
- Do not open the market in two tabs at once while testing this.
- Build a fresh circuit before logging in rather than during the session.
- If it persists across addresses and a browser restart, treat it as the serious case and change the password from an address you have checked.
What a session actually is here
A short lived token the site hands you after a successful login, held by the browser and sent back on every request. It is not tied to you in any deeper sense, which is why anything that discards it, blocks it or changes the shape of your connection can end a session that was perfectly valid a second earlier.
That also means a session is worth as much as a password to somebody who gets hold of one, and it is the reason a copied page that proxies your login through to the real site is more damaging than one that simply collects a password. It ends up holding a live session rather than a credential you can change.