if I switch in browser from WebFig to terminal, no problem. If I switch back from terminal to WebFig, I am logged off automatically and I find this entry in the log:
login failure for user admin from 172.16.1.x via web
I disabled everything in IP → Services except ssh (22), winbox (8291) and www-ssl (443). These services are just reachable from 172.16.1.0/24, for using www-ssl I generated a certificate. I don’t think it is an attack because I can reproduce this entry with the way I described above, but I don’t understand why this happens.
I discovered that it happens when I switch to terminal and back immediately after login (adress line https://172.16.1.1/webfig/). If I call a menu item (e. g. Log, adress line https://172.16.1.1/webfig/#Log) before switching to terminal and back it works fine. Also when I log off it don’t like the call of https://172.16.1.1/webfig/ triggerd via button and logs login failure for user admin from 172.16.1.x via web.
I also posted this topic to German MikroTik forum and found a user who confirmed the problem. My first assumption, that there is something wrong with the certificate or configuration for www-ssl, was wrong, he reproduced it with www.
Is that a know issue? Can someone reproduce it on 7.x? If 7.x contains the error, that maybe would be worth a bug report?