Page MenuHomePhabricator

Cradle session expires too fast
Closed, ResolvedPublicBUG REPORT

Description

"Now, I am losing the session with Cradle very quickly, causing data loss. For example, I performed OAuth at 2:10 pm and at 2:11 pm the login expired, not creating the item with the data filled in the form. I don't know if this behavior is expected, or if it is configured this way for security reasons. Or even if there is something I can do to overcome the issue and stay connected."

Steps to replicate the issue (include links if applicable):

What happens?:

  • Spinner at the top keeps spinning
  • No item is created
  • Press F5 and see that the session is lost, since it appears "Log in to save!" instead of my username

What should have happened instead?:

  • New item is created
  • Clear the form once the item is created (I suppose)
  • Keep connected at least until I close the window

Software version (skip for WMF-hosted wikis like Wikipedia):

  • MediaWiki 1.39.5
  • PHP 7.4.33 (apache2handler)
  • MariaDB 10.5.15-MariaDB-log
  • ICU 67.1
  • Pygments 2.11.2
  • Lua 5.1.5
  • LilyPond 2.22.0
  • Elasticsearch 7.10.2

Other information (browser name/version, screenshots, etc.):

  • Hosted at wikibase.cloud

Patches

Event Timeline

It seems the root level widar cookie is set as a session cookie: https://github.com/wbstack/magnustools/blob/785d4965a672a5d9e7b82cc20d3f18186186223d/classes/OAuth.php#L90-L98 when the credentials it maps to are persisted with a Max-Age of 7776000 (a month): https://github.com/wbstack/magnustools/blob/785d4965a672a5d9e7b82cc20d3f18186186223d/classes/OAuth.php#L301

It would probably make sense and align these values, or have the widar cookie expire only slightly earlier so that it cannot map to expired OAuth credentials.

Fring removed Fring as the assignee of this task.Jan 8 2024, 3:55 PM
Fring moved this task from Doing to In Review on the Wikibase Cloud (Kanban board Q4 2023) board.
Fring subscribed.
dang removed dang as the assignee of this task.Jan 12 2024, 1:55 PM
dang subscribed.

The changes in magnustools now still need to be consumed in widar.

Fring removed Fring as the assignee of this task.Jan 29 2024, 2:47 PM
Fring moved this task from Doing to In Review on the Wikibase Cloud (Kanban board Q4 2023) board.
Fring removed Fring as the assignee of this task.Feb 5 2024, 9:52 AM
Tarrow updated the task description. (Show Details)
Tarrow updated the task description. (Show Details)