On WMF sites, when a user is prompted to change their password during login (soft password reset), and then changes their password, their session seems to fail and they are no longer logged in. Logging in with the new password works as expected.
Description
Description
Related Objects
Related Objects
Event Timeline
Comment Actions
Untested guess:
- User logs in, session gets set up (here).
- User gets sent to the change password form (from here).
- Password change resets the token (here), but the session doesn't get updated.
- ∴ Session is no longer valid due to mismatched token.
If that's the case, AuthManager should fix this because it changes the order of events:
- User starts logging in.
- User changes password during the login process. Token gets reset.
- Login completes and session gets set up.
- ∴ Session is valid because the token didn't get changed after it was set up.
Comment Actions
The success page of the password change is shown as you are logged in, but when than clicking to another page, you are not logged in (even the details to echo notifications on the success page says, that your are not logged in, because that is using api requests for the detail information).