When the user logs out in a different browser, Watchlist and RC page with New Filters should behave appropriately
Closed, ResolvedPublic
Actions

Description

The problem on Watchlist

Do the following steps on Watchlist with the New Filters active:

Log in.
Click on Live updates.
Wait 10 seconds.
Open a different broswer
Open some local wiki page and log in
Wait 10 seconds.
Log out.
Go back to the first browser

Expected result: Watchlist logs out, Live Update stops updating, and the system lets the user know what has happened.
Actual result: Live Update keeps going (at least the animation does); the status appears to be logged in, since the "Log out" link is displayed at upper right; but the system offers this confusing message: "No changes during the given period match these criteria."

The problem is actually broader than just Live Update. If you log out in one browser then go to another one showing your Watchlist, as soon as you try to do something on that Watchlist, you should be logged out and no Watchlist should be displayed (because logged out users have no Watchlist). That's how the old Watchlist worked. But the new filters don't log you out, even if you do a search (though you get no results). You will be logged out if you click on an article link...

The solution on Watchlist

As soon as the user tries to do any action on Watchlist, log the user out and bring him to this page (which displays the message "Please log in to view or edit items on your Watchlist.")
- Every time Live Update tries to update, that should be considered an "action" for the above purposes.

The problem on Recent Changes

Do the following steps on Recent changes with the New Filters active:

Log in.
Click on Live updates.
Wait 10 seconds.
Open a different browser
Open some local wiki page and log in
Wait 10 seconds.
Log out.
Go back to the first browser

Expected result: The system logs out and the page refreshes with the logged-out version of Recent Changes.
Actual result: Recent Changes does NOT log out, and Live Update keeps updating. Filters that are not available in a logged out state (e.g., Watchlist filters) are still available in the menu, but they DON'T DO ANYTHING (meaning the user thinks she's getting a search she's actually not).

The solution on Recent changes

As soon as the user tries to do any action on Recent Changes, log her out and refresh the page with the logged out version of Recent Changes showing the default filter set (i.e., all previous filter settings are lost). If Live Update was active, it stops.
- Every time Live Update tries to update, that should be considered an "action" for the above purposes.

Details

	Project	Branch	Lines +/-	Subject
	mediawiki/core	master	+40 -8	Fix how "Live updates" behave when user logs out

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
Resolved	SBisson	T167743 Implement 'Live Updates' feature for RC page filters
Resolved	Catrope	T173614 Graduate Live Update out of beta
Resolved	• Petar.petkovic	T177717 When the user logs out in a different browser, Watchlist and RC page with New Filters should behave appropriately

Event Timeline

IKhitron created this task.Oct 8 2017, 1:54 PM

Restricted Application added a project: Collaboration-Team-Triage. · View Herald TranscriptOct 8 2017, 1:54 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

@IKhitron Did the following steps are the steps that you did?

I am logged in (en.wikipedia.org) on desktop and on a mobile phone
On both devices I am on RC page. On desktop RC page is with enabled 'Live updates'; on the mobile there is not 'Live updates', so I do nothing.
I am logging out from mobile; my desktop RC with 'Live updates' keeps updating the page as usual. I am changing filters and other parameters on the page - the page changes accordingly and I am still being logged in.
When I navigate to a different page on the desktop, I will be logged out and I will see RC page as an anon user. As anon user, I do not have 'Live updates', but otherwise, all is working as expected.

In T177717#3676860, @Etonkovidova wrote:

@IKhitron Did the following steps are the steps that you did?

I am logged on on the same desktop computer, Firefox and Chrome.
It's Liveupdate on on FF and some page on Chrome.
FF gives me new updates.
I logout from Chrome.
After 5 seconds I see this message on FF. There are no updates any more.

Thank you.

Thanks, @IKhitron - we will triage the issue.

In T177717#3676887, @IKhitron wrote:

In T177717#3676860, @Etonkovidova wrote:

@IKhitron Did the following steps are the steps that you did?

I am logged on on the same desktop computer, Firefox and Chrome.

It's Liveupdate on on FF and some page on Chrome.

FF gives me new updates.

I logout from Chrome.

After 5 seconds I see this message on FF. There are no updates any more.

Thanl you.

I have tried exact steps as described, but Live updates just keep arriving. Message "No changes during the given period match these criteria." is NOT showing.
For me, it is behaving like @Etonkovidova described above (in T177717#3676860).

My "Live updates" keeps updating the page as usual. I am changing filters and other parameters on the page - the page changes accordingly and I am still being logged in.

When I navigate to a different page on the desktop, I will be logged out and I will see RC page as an anon user. As anon user, I do not have 'Live updates', but otherwise, all is working as expected.

I was using Chrome 62 and Firefox 58 for testing.

Trizek-WMF added a parent task: T173614: Graduate Live Update out of beta.Nov 28 2017, 5:23 PM

Trizek-WMF added a subscriber: Trizek-WMF.

I just tried again and get exactly the same message.

I can't reproduce this either. When I log out in the other window, it just keeps Live Updating until i click on something, at which point it logs me out. @IKhitron, can you perhaps try this again and record precisely the steps you are taking, making sure you don't leave any out?

In T177717#3793468, @jmatazzoni wrote:

I can't reproduce this either. When I log out in the other window, it just keeps Live Updating until i click on something, at which point it logs me out. @IKhitron, can you perhaps try this again and record precisely the steps you are taking, making sure you don't leave any out?

I'm on last FF.
Logged in.
Go to Watchlist with rcfilters tab.
Click on Live updates.
Wait 10 seconds.
Open Chrome.
Open some local wiki page.
Login.
Wait 10 seconds.
Logout.
Go back to FF.
Stare the Watchlist.
After 5 seconds the message appears.

OK, I see it now. I was using Recent Changes, which, unlike Watchlist, keeps on updating. On Watchlist you indeed do get logged out. I'm not sure why. Yes. The message should say:

You have been logged out. Log in again to continue.

And, BTW, it doesn't matter if you use different browsers. I used Chrome for both sessions and got the same result.

In T177717#3794112, @jmatazzoni wrote:

OK, I see it now. I was using Recent Changes, which, unlike Watchlist, keeps on updating. On Watchlist you indeed do get logged out. I'm not sure why. Yes. The message should say:

You have been logged out. Log in again to continue.

I could not see the problem for the same reasons. Was using RC, instead of WL page.
Thank you @IKhitron for reporting the issue and for detailed description on how to reproduce.

I know why it logs out, @jmatazzoni. It's because logging out on some device logs you out automatically from all your current sessions. The problem is the message text.

You are welcome. :-)

Naive question: isn't it a normal security feature to be logged out everywhere if you log-out from one place?

@Trizek-WMF It's common to kill all sessions started by one user as soon as user logs out on one of the devices or browsers/tabs.

What's most interesting in this bug, it's RC page behavior. RC page with On Watchlist (or New Watchlist changes, or Not on Watchlist) and active Live update. After a user logs out on a different tab/browser, theRC page UI will not have any indication that log-out event has happened. The result set will be silently default to anon default filters. I am updating the ticket description and elevate the priority.

! In T177717#3797644, @Etonkovidova wrote:

....After a user logs out on a different tab/browser, theRC page UI will not have any indication that log-out event has happened.

Thanks Elena. That sounds like a separate issue. Will you please write a ticket for that, and we can discuss the appropriate remedy there? Thanks.

Etonkovidova updated the task description. (Show Details)Nov 29 2017, 7:26 PM

@jmatazzoni

That sounds like a separate issue.

The underlying cause for the issue is the same for both RC page and Watchlist. User session handling needs to be improved.

Let's keep it as one ticket for now. Per dev feedback, they can be separated later.

PS. I've updated the ticket description.

Etonkovidova edited projects, added Collaboration-Team-Triage (Collab-Team-This-Quarter); removed Collaboration-Team-Triage.Nov 29 2017, 7:31 PM

• jmatazzoni renamed this task from Liveupdate shows wrong message on logout to When the user logs out in a different browser, Watchlist and RC page with New Filters should behave appropriately.Dec 6 2017, 12:47 AM

• jmatazzoni updated the task description. (Show Details)

• jmatazzoni added subscribers: Catrope, SBisson.

That was actually kind of knotty. It's not really about Live Update—it's about any action that the user takes after the log out in a different browswer. But we do have to also make it so that any Live Update update is considered an "action." @Catrope and @Etonkovidova, you might want to have a look and make sure the solutions I've recommended make sense to you. They are based on what the system did before the New Filters.

• Petar.petkovic claimed this task.Dec 13 2017, 4:56 PM

• Petar.petkovic moved this task from Ready for Pickup to In Development on the Collaboration-Team-Triage (Collab-Team-This-Quarter) board.

Change 398126 had a related patch set uploaded (by Petar.petkovic; owner: Petar.petkovic):
[mediawiki/core@master] Fix how "Live updates" behave when user logs out

https://gerrit.wikimedia.org/r/398126

gerritbot added a project: Patch-For-Review.Dec 13 2017, 9:23 PM

• Petar.petkovic moved this task from In Development to Needs Review on the Collaboration-Team-Triage (Collab-Team-This-Quarter) board.Dec 13 2017, 9:23 PM

• Petar.petkovic moved this task from Needs Review to QA Review on the Collaboration-Team-Triage (Collab-Team-This-Quarter) board.Dec 18 2017, 4:03 PM

• Petar.petkovic removed a project: Patch-For-Review.

Change 398126 merged by jenkins-bot:
[mediawiki/core@master] Fix how "Live updates" behave when user logs out

https://gerrit.wikimedia.org/r/398126

ReleaseTaggerBot added a project: MW-1.31-release-notes (WMF-deploy-2018-01-02 (1.31.0-wmf.15)).Dec 18 2017, 5:00 PM

Given that betalabs handles user sessions rather erratically (kicking out of user sessions and re-login), as far as I could check, the specs have been implemented.

A user with enabled 'Live updates' on Watchlist will be redirected to the Login page after the next cycle of fetching the update.
A user with enabled 'Live updates' on Recent Changes will be redirected to the non-login RC page (no Saved filters, no Watchlist based filters).

Without enabled 'Live updates' - the behavior is the same as described above when a user will perform any action on RC or Watchlist pages.

Note: I will check throughly upon deployment to testwiki.

QA Recommendation: Resolve

Etonkovidova moved this task from QA Review to Product Review on the Collaboration-Team-Triage (Collab-Team-This-Quarter) board.Dec 19 2017, 12:02 AM

• jmatazzoni closed this task as Resolved.Dec 19 2017, 12:22 AM

Checked in wmf.15 (testwiki) - works as expected.

When the user logs out in a different browser, Watchlist and RC page with New Filters should behave appropriatelyClosed, ResolvedPublicActions