Session issues for some users (post MW1.27)
Closed, ResolvedPublic

Description

Steps to reproduce:

  1. Log in to hub wiki
  2. View a page on another wiki
  3. Notice that you're logged out of all wikis
Saftzie created this task.Dec 16 2016, 10:19 PM

This works for me. One thing I did notice earlier is that I had to completely clear all of my cookies for ShoutWiki to be able to even login, so there's definitely an issue with cookies somewhere although as far as I can work out it's a case of clearing them for everyone.

This is one of the two major issues we hit in 1.27.

I delete all my cookies every time I close my browser, so every session is a fresh session. It's not a cookie issue.
Screenshots:

I'm logged in on hub.

I go to Cook's test wiki, which logs me out. There's nothing special about the wiki. I can be any wiki. I just picked this one. Not only is the "LOG IN" link shown, but the skin changes to Cologne Blue, instead of Vector.

Upon refreshing the hub page, I see I'm also logged out from hub. I'm "Anonymous" and the skin is Aurora, instead of Vector.

lewiscawte renamed this task from Viewing "other" wiki pages logs out users to Session issues for some users (post MW1.27).

Hmm, it's worse. Log in to Cook's test wiki.

Refresh the page. I'm logged out.

List of cookies

I don't know if there have been changes or maybe I just wasn't as thorough yesterday.

Logging into hub gives me these cookies.

In T144#2122, @Saftzie wrote:

It seems I'm not alone.

That has been known for a while.

It was a side effect when we tried to roll out 1.27. It was one of two issues that stopped us deploying it. The other one we fixed yesterday.

This one seems to be on a per user basis. @jack was never affected. I was originally, however, after clearing all my cookies for the site, I'm no longer able to reproduce this issue. Looking at the CVN feed, it doesn't appear to be affecting many people very significantly.

If people want to list their browsers, OS' and how they cleared their cookies, go ahead.

All we know is that 1.27 significantly changed it's handling of sessions and authentication internally. We've tried to mitigate this by moving our sessions to a 1.27 friendly source beforehand, but it only seems to have helped some people. Sessions and cookies aren't the easiest of things to debug on a busy production environment, unfortunately.

Saftzie updated the task description. (Show Details)Dec 17 2016, 11:05 PM
Saftzie added a comment.EditedDec 17 2016, 11:13 PM
In T144#2122, @Saftzie wrote:

It seems I'm not alone.

That has been known for a while.

It seems the same, though. Log in on hub, visit another sw wiki, get logged out.

If people want to list their browsers, OS' and how they cleared their cookies, go ahead.

I've tried 2 Firefox versions on 2 PCs: FF10 on Linux, FF50 on Windows. Cookies are cleared when I close the browser. I've also cleared them all with options/show-cookies/clear-all.

I have had no trouble on WikiMedia sites, which have been running MW 1.27+ for a while. I log in regularly there. I can hop among projects without any difficulty. WikiMedia has a different central authentication architecture, however, no doubt.

lewiscawte triaged this task as Unbreak Now! priority.Dec 17 2016, 11:36 PM

So I've been able to reproduce this after downloading an additional browser and using my bot account on Firefox.

Do you use the "Remember my login" checkbox when you log in? I'd like to rule this in/out as it seems to "fix" things in my test(s).

Okay - so upon not very extensive, further testing. My current conclusion is that:

The issue involves logging into any wiki then changing to another wiki. Hub has been mentioned a lot of times as the test (as is the other site most users will go to other than their own) however it works with any combination of any two sites.

The issue occurs when a user does not tick the "Keep me logged in" button. For an unknown reason - when changing site without this ticked, the ShoutWiki_session and ShoutWikiUserID cookies disappear - despite these having an expiry of longer than a month. However, when this is ticked, a user will retain all their cookies (including the additional ShoutWikiToken cookie). Looking at the screenshots provided by @Saftzie seems to confirm the behaviour.

Whether this is cookies or not, remains to be seen, however, these appear to be the facts and it now appears the issue is a difference between choosing to tick the box.

This almost seems like sensible behaviour especially if a cookie is meant to be for one site, however, this is not how it has previously worked, and we want a session to last for the duration of a person's visit to ShoutWiki (at a minimum, and definately longer if they click the box)

@Saftzie's talk page provides some useful insight on what's happening. MediaWiki is, for some reason, expiring ShoutWiki_session and ShoutWikiUserID.

PERCE-NEIGE added a subscriber: PERCE-NEIGE.EditedJan 12 2017, 5:03 PM

I can't even log to my session or on Shoutwiki.com.
Can't use my wiki, and add pages, since the Mediawiki software update.

Should be fixed?

lewiscawte closed this task as Resolved.Mar 29 2017, 3:44 PM
lewiscawte claimed this task.