Page MenuHomePhorge

Unable to save edits due to loss of session data
Open, Needs TriagePublic

Description

Since the 1.35 upgrade I have on several occasions been unable to save edits due to "loss of session data". It happens somewhat randomly, sometimes the edits go through fine. I have tried logging out and back in, without success.

I assume it's something to do with the shared login, because Hub and wikis with custom domains are unaffected.

Event Timeline

So you're getting this on *.shoutwiki.com sites, but, not Hub or custom domain sites? That's a little odd.

I must admit - I've been running into some session things, though, mostly on our internal/staff tools.

After the recent upgrade to 1.39 this is still an issue for me. (No idea if other users are affected as well.)

Interestingly the behavior seems to be same as in T144 many years ago: Login and untick "keep me logged in" and you're immediately logged out when visiting any other wiki than Hub. Or tick it and you remained logged in but can't execute any actions, except by using API sandbox.

To be honest, this is pretty much a WONTFIX at the moment. I'm having a real problem reproducing this reliably, but, mostly for the details below. In my testing, I've had one instance where I've dropped a session today, and that was only when I went back to Hub.

The best results I've had is wiping all my cookies and sessions for all shoutwiki.com domains/subdomains as well as custom domains. Signing in on a HTTPS .shoutwiki.com subdomain and hitting keep me logged in, then relogging in on any custom domains (again, on HTTPS). Very rarely I get a session security issue but you try the request again and it usually works.

There is also a related bug with Anubis and sessions at the minute, which I'll explore when I get more time.

The fix will only come when we implement a proper session and SSO provider as browsers are becoming more strict and making sessions more complicated for multi-site operators/devs - at the minute a lot of the stuff that makes this work in MediaWiki is stuffed into CentralAuth, but, really needs to be split out (and there are upstream tasks waiting on some dev time) to be properly repurposable (because they've admitted CentralAuth is rather WMF centric)