This is a good change because it prevents people from scamming cookies
1 Like
That explains my pains with my gameâs github CI throwing HTTP 400 errors when I try to publishâŚ
Unfortunately the community tooling hasnât caught up with the cloud API yet, so thereâs still a bit of reliance on cookie-based authentication, and this is definitely a detrimental change. Not to mention I believe some tooling CI uses cookie authentication to be able to run studio for testing. (since it requires authentication)
3 Likes
Yeah, but it would be much better if this could be an option for all users.
1 Like
This is a feature that should have been done years ago, itâs about time they did something to actually prevent account theft.
They need to get this rolled out to 100% as soon as possible.
Next thing we need is the ability to require the account pin for sending/accepting trades and making purchases.
3 Likes
Itâs already rolled out, and as much as I agree with your statement you also need to understand the side-effects where the users that play VPN/VM will have to login every time. Developers that gather data for their game through Roblox APIâs will have trouble with that.
So, this should have been optional.
1 Like
I use a VPN too but allowing it to be an option is just compromising security for convenience and leaves open the ability for scammers to use social engineering tactics for getting people to use the setting and allow IP changes.
Well, I think at this point they would rather make .exe files or social engineer their way into making you send the trade/Robux to them.
2 Likes
I personally never got hacked where someone has got my .ROBLOSECURITY cookie.
It was more about loop-holes and tricks that I/Roblox Support fell for.
2 Likes
Making this optional would bring more benefit to people rather than harm.
5 Likes
Vouch. Xfinity keeps your IP static.
Verizon on the other hand. If your ONT loses power, you will have a new IP generated. I went from a server in Dallas to one in Richmond. This would be very annoying to loose my logged in account on verizon networks just because my network lost power.
2 Likes
Yea, for users and studio users, this is a great update! But there is a whole community that uses Roblox API in projects and websites and such, who rely on logging in with a cookie that wonât expire so they can grab data. This update was pushed without being announced and gave no secondary solution to API users like most of us on this thread (including myself)
3 Likes
Yeah I guess an option is more preferable as someone above mentioned.
3 Likes
Unfortunately I canât see roblox making this an option, many people wonât understand it. Either way they need to do something, they canât leave it this way.
3 Likes
I completely disagree. This should be an advanced setting that warns you about the risks and you have like to wait 10 seconds before confirming.
This could also be in the Open Cloud console, where normal players wouldnât even run into it.
This completely ruins many 3rd party ROBLOX systems, and imo causes more damage than it fixes. People who are vulnerable to cookie logging are also probably vulnerable to being ratted, social engineered, etc.
9 Likes
This change is incredibly frustrating, but sadly shows how Roblox sees the developers who build outside integrations. With absolutely no warning made available to this change, and with Open Cloudâs APIs far from release, Roblox has just broken hundreds, if not more, of integrations that rely on cookies to rank in groups, monitor group security, and more.
11 Likes
This is a major issue for developers, and groups. Itâs not always feasible to expect ranking to work on my services, or servers when they are scaled [meaning different machines/IP addresses handle requests]. We really need an alternative to .ROBLOSECURITY authentication or I hope this change is undone. I really hope to see an official response about this, as this is detrimental to all developers who create integrations with Roblox, and is hurting thousands of users who rely on these tools.
12 Likes
Cookies are typically meant to have an expiration date for security reasons. The idea is to automatically re-generate the cookie in the background upon its expiration to prevent bad actors from making use of the old one, while not forcing the user to re-authenticate.
Regarding the IP change cookie invalidation, you make a good point since some devs use cookies for automation purposes. Roblox should give us the ability to whitelist certain IPs to fix this issue while increasing the level of security with regards to cookies being stolen or given out.
3 Likes
I understand this change is overall to protect account security, but as stated a multitude of times in this post this really puts a huge strain on most forms of automation. Iâm hoping Roblox is willing to reconsider this, or at the very least make a viable solution for people who legitimately use forms of automation. Even a heads up would of been nice and given me some time to create something thatâs compliant with this change, but unfortunately myself and a lot of my friends are scrambling right now to ensure there isnât too much downtime regarding various automation bots.
1 Like
@xChris_vC and I run RocketApps. (application centre and Roblox API provider). We are noticing more requests failing than usual but still about 60%, maybe even a little more, goes through like usual.
We have no idea why some cookies got invalidated and others havenât.
Due to the way that our system was designed, every request to the Roblox API is being sent from another IP address.
Are we certain Roblox is invalidating cookies based on the IP address theyâre being created with (login)?
5 Likes
This is part of an A/B test of a new security feature. These sorts of things really should be announced prior to being a thing.
A decent chance this change wasnât rolled to your remaining cookies. It must have only been rolled out to some % of Roblox users (which is well what A/B testing is).
4 Likes