"No active login attempt is in progress for your session." when trying to log in on wikisource.org
Closed, DuplicatePublic
Actions

Assigned To

None

Authored By

	Catrope
	Sep 13 2016, 6:09 PM

Description

I (User:Roan Kattouw (WMF)) repeatedly tried logging in on wikisource.org, and got a "No active login attempt is in progress for your session." error message. I'm logged in just fine on www.mediawiki.org. Trying to go to www.wikisource.org redirects to wikisource.org. I get the same bug if I try to log in with my non-staff account (User:Catrope).

Related Objects

Mentioned In: T351685: I keep getting logged out on Wikisource
T249526: Misleading warning raised by the login API: "Fetching a token via action=login is deprecated"
T249307: Unable to login to wikisource.org: "No active login attempt is in progress for your session."
T224712: Attempt to login fails several times
T156847: Core should be aware of the domain it is running on and render mobile domains where necessary
T171398: On mobile domain, interwiki links for WMF wikis should be resolved as mobile rather than desktop
T146843: Re-evaluate how we implement phabricator's search engine
T112730: Failure to OAuth after login on mobile
Mentioned Here: T156847: Core should be aware of the domain it is running on and render mobile domains where necessary
T198515: "No active login attempt is in progress for your session" (LG K10 (2017))
T169261: Users unable to remain logged in, associated with attempts to upgrade the password hash on every login
T112730: Failure to OAuth after login on mobile
P4037 Headers for failed login at wikisource

Event Timeline

Catrope created this task.Sep 13 2016, 6:09 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 13 2016, 6:09 PM

Catrope triaged this task as Unbreak Now! priority.Sep 13 2016, 6:09 PM

Restricted Application added subscribers: Jay8g, Luke081515, TerraCodes. · View Herald TranscriptSep 13 2016, 6:09 PM

greg subscribed.Sep 13 2016, 6:19 PM

Headers:

P4037 Headers for failed login at wikisource

1	POST https://wikisource.org/w/index.php?title=Special:UserLogin&returnto=Main+Page
2	Host: wikisource.org
3	User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:48.0) Gecko/20100101 Firefox/48.0
4	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
5	Accept-Language: en-US,en;q=0.5
6	Accept-Encoding: gzip, deflate, br
7	Referer: https://wikisource.org/w/index.php?title=Special:UserLogin&returnto=Main+Page
8	Cookie: GeoIP=US:CA:San_Francisco:37.79:-122.39:v4; forceHTTPS=true; centralauth_User=Roan+Kattouw+%28WMF%29; centralauth_Session=REDACTED; CP=H2; WMF-Last-Access=13-Sep-2016; sourceswikimwuser-sessionId=REDACTED; sourceswikiUserName=Catrope; sourceswikiSession=REDACTED; forceHTTPS=true
9	Connection: keep-alive
10	Upgrade-Insecure-Requests: 1
11
12	302 Found
13	Accept-Ranges: bytes
14	Age: 0
15	Backend-Timing: D=1176846 t=1473790625607204
16	Cache-Control: private, s-maxage=0, max-age=0, must-revalidate
17	Content-Encoding: gzip
18	Content-Length: 20
19	Content-Type: text/html; charset=utf-8
20	Date: Tue, 13 Sep 2016 18:17:06 GMT
21	Expires: Thu, 01 Jan 1970 00:00:00 GMT
22	Location: https://login.wikimedia.org/wiki/Special:CentralLogin/start?token=REDACTED
23	Server: mw1244.eqiad.wmnet
24	Set-Cookie: sourceswikiSession=REDACTED; path=/; secure; httponly
25	sourceswikiUserID=166511; expires=Thu, 13-Oct-2016 18:17:06 GMT; Max-Age=2592000; path=/; secure; httponly
26	sourceswikiUserName=Roan+Kattouw+%28WMF%29; expires=Thu, 13-Oct-2016 18:17:06 GMT; Max-Age=2592000; path=/; secure; httponly
27	forceHTTPS=true; path=/; httponly
28	centralauth_User=Roan+Kattouw+%28WMF%29; expires=Thu, 13-Oct-2016 18:17:06 GMT; Max-Age=2592000; path=/; secure; httponly
29	centralauth_Session=REDACTED; path=/; secure; httponly
30	Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
31	Vary: Accept-Encoding,X-Forwarded-Proto,Cookie,Authorization
32	Via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
33	X-Cache: cp1066 pass, cp2013 pass, cp4016 pass, cp4017 pass
34	X-Firefox-Spdy: h2
35	p3p: CP="This is not a P3P policy! See https://wikisource.org/wiki/Special:CentralAutoLogin/P3P for more info."
36	x-analytics: WMF-Last-Access=13-Sep-2016;https=1
37	x-cache-status: pass
38	x-client-ip: 198.73.209.4
39	x-content-type-options: nosniff
40	x-powered-by: HHVM/3.12.7
41	x-varnish: 3574191485, 527365860, 3355738646, 1847884791
42
43	GET https://login.wikimedia.org/wiki/Special:CentralLogin/start?token=REDACTED
44	Host: login.wikimedia.org
45	User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:48.0) Gecko/20100101 Firefox/48.0
46	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
47	Accept-Language: en-US,en;q=0.5
48	Accept-Encoding: gzip, deflate, br
49	Referer: https://wikisource.org/
50	Cookie: WMF-Last-Access=13-Sep-2016; loginwikiUserName=Roan+Kattouw+%28WMF%29; GeoIP=US:CA:San_Francisco:37.79:-122.39:v4; CP=H2
51	Connection: keep-alive
52	Upgrade-Insecure-Requests: 1
53
54	302 Found
55	Accept-Ranges: bytes
56	Age: 0
57	Backend-Timing: D=27271 t=1473790628053316
58	Cache-Control: private, s-maxage=0, max-age=0, must-revalidate
59	Content-Encoding: gzip
60	Content-Length: 20
61	Content-Type: text/html; charset=utf-8
62	Date: Tue, 13 Sep 2016 18:17:08 GMT
63	Expires: Thu, 01 Jan 1970 00:00:00 GMT
64	Location: https://wikisource.org/wiki/Special:CentralLogin/complete?token=REDACTED
65	Server: mw1247.eqiad.wmnet
66	Set-Cookie: loginwikiSession=REDACTED; path=/; secure; httponly
67	loginwikiUserID=5495826; expires=Thu, 13-Oct-2016 18:17:08 GMT; Max-Age=2592000; path=/; secure; httponly
68	loginwikiUserName=Roan+Kattouw+%28WMF%29; expires=Thu, 13-Oct-2016 18:17:08 GMT; Max-Age=2592000; path=/; secure; httponly
69	forceHTTPS=true; path=/; httponly
70	centralauth_User=Roan+Kattouw+%28WMF%29; expires=Thu, 13-Oct-2016 18:17:08 GMT; Max-Age=2592000; path=/; secure; httponly
71	centralauth_Session=REDACTED; path=/; secure; httponly
72	Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
73	Vary: Accept-Encoding,X-Forwarded-Proto,Cookie,Authorization
74	Via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
75	X-Cache: cp1052 pass, cp2010 pass, cp4016 pass, cp4017 pass
76	X-Firefox-Spdy: h2
77	p3p: CP="This is not a P3P policy! See https://login.wikimedia.org/wiki/Special:CentralAutoLogin/P3P for more info."
78	x-analytics: WMF-Last-Access=13-Sep-2016;https=1
79	x-cache-status: pass
80	x-client-ip: 198.73.209.4
81	x-content-type-options: nosniff
82	x-powered-by: HHVM/3.12.7
83	x-varnish: 2301061874, 4235459159, 3355743678, 1847892698
84
85	GET https://wikisource.org/wiki/Special:CentralLogin/complete?token=REDACTED
86	Host: wikisource.org
87	User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:48.0) Gecko/20100101 Firefox/48.0
88	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
89	Accept-Language: en-US,en;q=0.5
90	Accept-Encoding: gzip, deflate, br
91	Referer: https://wikisource.org/
92	Cookie: GeoIP=US:CA:San_Francisco:37.79:-122.39:v4; forceHTTPS=true; centralauth_User=Roan+Kattouw+%28WMF%29; centralauth_Session=REDACTED; CP=H2; WMF-Last-Access=13-Sep-2016; sourceswikimwuser-sessionId=REDACTED; sourceswikiUserName=Roan+Kattouw+%28WMF%29; sourceswikiSession=REDACTED; forceHTTPS=true; sourceswikiUserID=166511; centralauth_User=Roan+Kattouw+%28WMF%29; centralauth_Session=REDACTED
93	Connection: keep-alive
94	Upgrade-Insecure-Requests: 1
95
96	200 OK
97	Accept-Ranges: bytes
98	Age: 0
99	Backend-Timing: D=34382 t=1473790628241509
100	Cache-Control: private, s-maxage=0, max-age=0, must-revalidate
101	Content-Encoding: gzip
102	Content-Language: en
103	Content-Length: 4318
104	Content-Type: text/html; charset=UTF-8
105	Date: Tue, 13 Sep 2016 18:17:08 GMT
106	Expires: Thu, 01 Jan 1970 00:00:00 GMT
107	Server: mw1275.eqiad.wmnet
108	Set-Cookie: sourceswikiSession=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure; httponly
109	sourceswikiUserID=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure; httponly
110	forceHTTPS=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; httponly
111	centralauth_User=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure; httponly
112	centralauth_Session=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure; httponly
113	Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
114	Vary: Accept-Encoding,Cookie,Authorization
115	Via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
116	X-Cache: cp1066 pass, cp2013 pass, cp4009 pass, cp4017 pass
117	X-Firefox-Spdy: h2
118	X-Frame-Options: DENY
119	p3p: CP="This is not a P3P policy! See https://wikisource.org/wiki/Special:CentralAutoLogin/P3P for more info."
120	x-analytics: ns=-1;special=CentralLogin;WMF-Last-Access=13-Sep-2016;https=1
121	x-cache-status: pass
122	x-client-ip: 198.73.209.4
123	x-content-type-options: nosniff
124	x-powered-by: HHVM/3.12.7
125	x-ua-compatible: IE=Edge
126	x-varnish: 3574199333, 527371591, 3919095061, 1847893469

If it's useful, I was unable to reproduce this using my staff account.

This problem went away after clearing all centralauth_Session cookies on all domains.

What seems likely to have happened here is something like this:

A login somewhere, without the "remember me" option, set the centralauth_Session cookie with domain=.wikisource.org.
- This might have been a login to a subdomain such as en.wikisource.org, or CA's auto-login web bugs for a login to a different subdomain.
The CA session expires on the server side.
The login on wikisource.org sets the centralauth_Session cookie as a host-only cookie (no domain set).
Per RFC 6265, the browser has two different cookies named centralauth_Session that match the current domain. Both have the same path attribute. The browser should send the earlier one first.
- Per the earlier RFC 2109, the cookie from step 1 does not match the base domain wikisource.org, so it all works fine for older browsers.
PHP uses the first cookie named centralauth_Session from the Cookie header. That's the cookie from step 1, not the cookie from step 3.
When CA comes back to wikisource.org to complete the login, it sees the CA session from the cookie doesn't match the CA information it expects in some manner and aborts.

For browsers following RFC 6265, the thing to do here would be to have wikisource.org set CA cookies with domain=.wikisource.org (or just domain=wikisource.org, the leading dot is supposed to be ignored). Then the cookies in steps 1 and 3 would be the same cookie instead of two different cookies and things would work fine. But that would break browsers following the older RFC 2109, because that RFC doesn't allow the domain wikisource.org to set cookies for domain=.wikisource.org (and domain=wikisource.org is considered invalid, the dot is required).

The most-compatible solution would probably be to change wikisource.org to www.wikisource.org or mul.wikisource.org, so it can set cookies for domain=.wikisource.org in all browsers.

• MZMcBride mentioned this in T112730: Failure to OAuth after login on mobile.Sep 13 2016, 11:13 PM

• MZMcBride subscribed.

@Catrope: I asked over at T112730#2631045 about looking at logs to see how frequent/common this error is. Could you or someone do that?

(When redacting session IDs, leaving the first few characters in makes debugging a lot easier.)

In T145545#2634527, @Anomie wrote:

For browsers following RFC 6265, the thing to do here would be to have wikisource.org set CA cookies with domain=.wikisource.org (or just domain=wikisource.org, the leading dot is supposed to be ignored). Then the cookies in steps 1 and 3 would be the same cookie instead of two different cookies and things would work fine. But that would break browsers following the older RFC 2109, because that RFC doesn't allow the domain wikisource.org to set cookies for domain=.wikisource.org (and domain=wikisource.org is considered invalid, the dot is required).

We could just detect it when the domain equals the current domain and set both the domain cookie and the host-only cookie. But yeah, in general running two independent applications on a domain and its subdomain is a horrible idea. Even more so if the two applications use the same software and thus identical cookie names.

In T145545#2635325, @MZMcBride wrote:

@Catrope: I asked over at T112730#2631045 about looking at logs to see how frequent/common this error is. Could you or someone do that?

With the help of a few people, https://gerrit.wikimedia.org/r/313547 has now been merged. Yay.

I don't know when it will go live in production. There are some upcoming meetings and freezes, I think.

• MZMcBride mentioned this in T146843: Re-evaluate how we implement phabricator's search engine.Oct 1 2016, 4:26 PM

Tgr added a parent task: T156847: Core should be aware of the domain it is running on and render mobile domains where necessary.Feb 1 2017, 9:34 PM

This error occurs for some users. Cleaning all cookies does not help.
Is there some temporary solution procedure that can be proposed?

If clearing *all* cookies does not help, it's probably a different bug.

In T145545#3408369, @Kaganer wrote:

This error occurs for some users. Cleaning all cookies does not help.
Is there some temporary solution procedure that can be proposed?

I think that bug is related with T169261 .

• Deskana unsubscribed.Jul 6 2017, 11:21 AM

Another instance of the error when logging to commons, on mobile: T198515