Page MenuHomePhabricator

Logging in does not actually log me in when I switch accounts on enwiki
Closed, InvalidPublic

Description

When I switch accounts on the English Wikipedia, User:Keegan to User:Keegan (WMF) or vice versa, I get login errors when attempting to edit.

  1. Log in as Keegan
  2. Log out
  3. Log in as Keegan (WMF)
  4. Edit a page, either source or VisualEditor
  5. Get warning about not being logged in
  6. Hit save, get warning about not being logged in
  7. Save edit, recorded as not logged in

Often when switching accounts my global/custom .js and .css do not load, when refreshing to load this does log me in.

Event Timeline

This does not reproduce on meta or mediawiki.org.

Refreshing is confirmed to log me in when editing or performing an action.

Can't reproduce with those steps and my personal/staff account.

@Keegan, I'm assuming this happened on March 11, and not a couple weeks ago when we were having some Session Manager issues, right?

This does look like a session issue, although I'm not seeing a security impact. If you don't mind that your screenshots are made public, are you ok with me making this a public bug so we get the benefit of more eyes on it?

I can't reproduce on enwiki either. You might clear all your cookies for wikipedia.org and all subdomains, in case you somehow have a bad cookie stuck.

If you can use something like Live HTTP Headers for Firefox or something similar for whatever browser you use to capture all the headers during steps 1-5, that would be helpful.

@csteipp I'm fine with it being public.
@Anomie I cleared all my cookies for wiki[?]edia, and removed the script that I was importing that may have caused cookie corruption between accounts. I'm no longer able to reproduce either, for now.

Phew.

csteipp removed a project: acl*security.
csteipp changed the visibility from "Custom Policy" to "Public (No Login Required)".
csteipp changed Security from Software security bug to None.

Closing for now. If it happens again, feel free to reopen. As Brad said, if there's a way to capture the http headers, that would definitely help tracking down what happened.