Page MenuHomePhabricator

Investigate UI asset caching
Closed, ResolvedPublicBUG REPORT

Description

I noticed that if we update the UI image (with new JS app bundle?) the dashboard sometimes breaks for me.

Used Software: Firefox Developer Edition 105.0b2 (64-bit) on Ubuntu 22.04.1 LTS

What happens?
I visit wikibase.cloud, navigate to my dashboard and it's broken. The list of wikis is the wrong count of entries and the data is missing. The /mine API request looks fine, my suspicion is that the app.js gets cached by the browser and somehow doesn't play nicely. If I would reload the page, everything worked fine, but the issue persisted and happened again on the next visit.

A possible solution could be to define some cache control headers for the ui js bundle in its nginx config.

The filenames of the js & css bundles contain a random string to avoid this problem, so I guess we have to look at something else. Maybe the html gets cached?

This article gives a decent overview of controlling client caching with http headers using nginx: https://www.howtogeek.com/devops/how-to-configure-cache-control-headers-in-nginx/
\

ACs:

  • we know the error source of this experience

image.png (807×1 px, 526 KB)

Peek 2022-08-25 12-24.gif (937×1 px, 660 KB)

Event Timeline

Deniz_WMDE updated the task description. (Show Details)
Deniz_WMDE updated the task description. (Show Details)

@Deniz_WMDE I'd also be interested to know the payload of the response to /mine as it looks both cached and broken? as the wiki names are not displayed.

FWIW, I have previously started using the dashboard and I think it looked like I was logged in, showing a list of wikis, but when I clicked the settings cog for the desired wikibase I suddenly found I was not.

This seems like a (fairly mild) security issue in the sense that the list of wikis owned by a user is private information and should not be cached beyond the expiry of the login cookie. It could be more important in a work or event situation where multiple people may use the same computer.

We just noticed that we do not terminate user sessions when logging out, this (or similar session handling) might come into play here https://github.com/wbstack/ui/blob/main/src/store/auth.js#L61

Deniz_WMDE claimed this task.