Page MenuHomePhorge

Session issues for some users (post MW1.27)
Closed, ResolvedPublic

Assigned To
Authored By
Saftzie
Dec 16 2016, 10:19 PM
Tags
None
Referenced Files
F695: image.png
Dec 17 2016, 11:02 PM
F689: image.png
Dec 17 2016, 11:02 PM
F693: image.png
Dec 17 2016, 11:02 PM
F691: image.png
Dec 17 2016, 11:02 PM
F679: image.png
Dec 17 2016, 9:55 PM
F681: image.png
Dec 17 2016, 9:55 PM
F683: image.png
Dec 17 2016, 9:55 PM

Description

Steps to reproduce:

  1. Log in to hub wiki
  2. View a page on another wiki
  3. Notice that you're logged out of all wikis

Event Timeline

This works for me. One thing I did notice earlier is that I had to completely clear all of my cookies for ShoutWiki to be able to even login, so there's definitely an issue with cookies somewhere although as far as I can work out it's a case of clearing them for everyone.

This is one of the two major issues we hit in 1.27.

I delete all my cookies every time I close my browser, so every session is a fresh session. It's not a cookie issue.
Screenshots:

I'm logged in on hub.

image.png (1×1 px, 280 KB)

I go to Cook's test wiki, which logs me out. There's nothing special about the wiki. I can be any wiki. I just picked this one. Not only is the "LOG IN" link shown, but the skin changes to Cologne Blue, instead of Vector.

image.png (1×1 px, 78 KB)

Upon refreshing the hub page, I see I'm also logged out from hub. I'm "Anonymous" and the skin is Aurora, instead of Vector.

image.png (1×1 px, 262 KB)

lewiscawte renamed this task from Viewing "other" wiki pages logs out users to Session issues for some users (post MW1.27).Dec 17 2016, 10:52 PM

Hmm, it's worse. Log in to Cook's test wiki.

image.png (1×1 px, 270 KB)

Refresh the page. I'm logged out.

image.png (1×1 px, 220 KB)

List of cookies

image.png (1×1 px, 69 KB)

I don't know if there have been changes or maybe I just wasn't as thorough yesterday.

Logging into hub gives me these cookies.

image.png (1×1 px, 68 KB)

In T144#2122, @Saftzie wrote:

It seems I'm not alone.

That has been known for a while.

It was a side effect when we tried to roll out 1.27. It was one of two issues that stopped us deploying it. The other one we fixed yesterday.

This one seems to be on a per user basis. @jack was never affected. I was originally, however, after clearing all my cookies for the site, I'm no longer able to reproduce this issue. Looking at the CVN feed, it doesn't appear to be affecting many people very significantly.

If people want to list their browsers, OS' and how they cleared their cookies, go ahead.

All we know is that 1.27 significantly changed it's handling of sessions and authentication internally. We've tried to mitigate this by moving our sessions to a 1.27 friendly source beforehand, but it only seems to have helped some people. Sessions and cookies aren't the easiest of things to debug on a busy production environment, unfortunately.

In T144#2122, @Saftzie wrote:

It seems I'm not alone.

That has been known for a while.

It seems the same, though. Log in on hub, visit another sw wiki, get logged out.

If people want to list their browsers, OS' and how they cleared their cookies, go ahead.

I've tried 2 Firefox versions on 2 PCs: FF10 on Linux, FF50 on Windows. Cookies are cleared when I close the browser. I've also cleared them all with options/show-cookies/clear-all.

I have had no trouble on WikiMedia sites, which have been running MW 1.27+ for a while. I log in regularly there. I can hop among projects without any difficulty. WikiMedia has a different central authentication architecture, however, no doubt.

lewiscawte triaged this task as Unbreak Now! priority.Dec 17 2016, 11:36 PM

So I've been able to reproduce this after downloading an additional browser and using my bot account on Firefox.

Do you use the "Remember my login" checkbox when you log in? I'd like to rule this in/out as it seems to "fix" things in my test(s).

Okay - so upon not very extensive, further testing. My current conclusion is that:

The issue involves logging into any wiki then changing to another wiki. Hub has been mentioned a lot of times as the test (as is the other site most users will go to other than their own) however it works with any combination of any two sites.

The issue occurs when a user does not tick the "Keep me logged in" button. For an unknown reason - when changing site without this ticked, the ShoutWiki_session and ShoutWikiUserID cookies disappear - despite these having an expiry of longer than a month. However, when this is ticked, a user will retain all their cookies (including the additional ShoutWikiToken cookie). Looking at the screenshots provided by @Saftzie seems to confirm the behaviour.

Whether this is cookies or not, remains to be seen, however, these appear to be the facts and it now appears the issue is a difference between choosing to tick the box.

This almost seems like sensible behaviour especially if a cookie is meant to be for one site, however, this is not how it has previously worked, and we want a session to last for the duration of a person's visit to ShoutWiki (at a minimum, and definately longer if they click the box)

@Saftzie's talk page provides some useful insight on what's happening. MediaWiki is, for some reason, expiring ShoutWiki_session and ShoutWikiUserID.

I can't even log to my session or on Shoutwiki.com.
Can't use my wiki, and add pages, since the Mediawiki software update.

lewiscawte claimed this task.