Page MenuHomePhabricator

Can't log into mobile on Commons
Closed, ResolvedPublic


For context I had a power outage, I restored the power, then after I had free time tried to edit a page to prepare a large import of books in the public domain in the mobile version of the MediaWiki editor and while trying to sign in got this message:

wp_ss_20180630_0001.png (2ร—1 px, 260 KB)

Then I wanted to see if I could otherwise sign into the desktop version and found out that I never signed out, please see:

wp_ss_20180630_0002.png (2ร—1 px, 563 KB)

The odd thing is that this problem persists, the device I'm running is a Microsoft Lumia 950 XL phablet with Microsoft Windows 10 Mobile (consumer build, latest version) while I use the Microsoft Edge browser (latest version).

Event Timeline

Restricted Application added a subscriber: Aklapper. ยท View Herald TranscriptJun 30 2018, 10:15 AM

FYI, clearing cookies didn't work. ๐Ÿ˜’๐Ÿช

Aklapper changed the task status from Open to Stalled.Jun 30 2018, 1:24 PM

Please see and follow and report back here. Thanks!

I tried all, but it only seems to affect Wikimedia Commons, look:

wp_ss_20180630_0003.png (2ร—1 px, 721 KB)

I just experimented with fake sign in names like "Donald Trunk" and "Donald Trungy" and on Wikimedia Commons in the mobile browser I keep getting the exact same comment while on the English Wikipedia the sign in interface (on mobile ๐Ÿ“ฑ) tells me that there's an invalid username or password, it seems odd that the mobile sign in interface of only, and I mean ONLG Wikimedia Commons can't recognise this.

@Aklapper Can an administrator look into my account to see if any cookies or something is broken? Here is the full log of my sign in attempts on Commonsmobile.

I first attempt to sign in from the Commonwiki UploadWizard on my wife's LG K10 (2017) cell.-phone to upload a few images I took as my camera on my Microsoft Lumia 950 XL is broken, in order to sign in I use the Ecosia browser... This failed, I got an error message that no active login attempt is happening at my session.

I then <strike>try</strike> tried to use Google Chrome on the same device (LG K10 (2017)) to no avail.

A day later I try to sign in on my Microsoft Lumia 950 XL phablet on mobile to import some PD books ๐Ÿ“š, I get the error message attached above, I then go to desktop mode to see if anything is wrong ๐Ÿ‘Ž๐Ÿป and to sign in from there, to my surprise I'm still signed in, from this point forward I must've tried a hundred times or so with different combinations to see if I could sign in, I cleared all cookies, I factory reset my wife's phone ๐Ÿ“ž (she really wasn't all to happy about that), I installed a different browser, none of that worked.

I thought that maybe my IP address was causing me to not sign in so I tried signing in on a different IP address using the same Microsoft Lumia 950 XL phablet, I still got the same error message, then I tried it around 5 different IP's from various providers at neighbours and friends and at the school where I teach, still no sign in.

Then I tried about using "a virgin computer ๐Ÿ’ป" (or in other words a computer where I have never signed in with the account User:Donald Trung or any other WMF account as far as I know, I don't really ask my friends if they have WMF accounts), after trying I still couldn't sign into Commonswikimobile.

So from what I can tell about this issue:

(1) It affects all devices where "User:Donald Trung" tries to sign in and then all subsequent accounts (real or fake).

(2) It affects all IP addresses.

(3) It affects all browsers.

(4) It affects all device types (e.g. Laptop, desktop, smartphone, phablet, Etc.).

Does your browser allow capturing the relevant HTTP requests and responses?

@Aklapper, not on my Microsoft Lumia 950 XL, I will try it on my wife's LG K10 (2017) later when I'm home ๐Ÿ  again. Microsoft Windows 10 Mobile ๐Ÿ“ฑ tends to have a very closed down system and often when attempting to report diagnostics I am forced to try and make a report only using the Microsoft Windows Feedback app, I will try to see if I could export one of those files ๐Ÿ“ to the Phabricator.

@Aklapper, others seem to be suffering from this situation too, please see:

This issue seems to be exclusive to Wikimedia Commons, could you please personally try to see if this example page:

Works with your Wikimedia (SUL-)account? Otherwise this might be an issue that affects some users but not others.

Aklapper renamed this task from Can't sign into the mobile browser, while I remain signed into the desktop version to Can't log into mobile on Commons, while I remain logged into the desktop version.Jul 5 2018, 12:15 PM

For the record, I can edit the Mobile version anonymously, but when I try to log in, I am automatically redirected to the Desktop version.

I also face this issue. I initially faced this when trying to login into the mobile meta website. I am unable to login to the mobile website of commons, either.

Trying to answer the question in the troubleshooting page,

Does it persist after clearing cookies for the wiki domain?


When logging in in incognito mode?


When logging in with a different kind of browser?

Yes! I tried logging in using Firefox Nightly 63.0a1 on an Android and Debian, Chromium 66.0.3359.117 on an Android and Debian, Chrome (version not known) on an Android Firefox Developer Edition 58.0b11 on a Debian.

Does it affect all user accounts, or just one?

It does seem to be affecting multiple accounts. I have two accounts and face the same issue in both. Further, there's another one (the one who started this task).

Does the "remember me" flag make any difference? (Clear cookies before attempts.)"


If the problems are happening on a WikiMedia wiki, try logging in on another wiki, preferably one that does not share a second-level domain name (so if the problem happens on, try for example

I am able to login to and but unable to login to or

Capture the relevant HTTP requests and responses (i.e. visiting the login page + submitting the login form + the resulting redirect;

I saved the requests and responses as HAR files. I'm not sharing it yet as I'm not which data I should sanitize out. I'll be ready to share it if given guidance about how to sanitize/share it.

Change 444464 had a related patch set uploaded (by Anomie; owner: Anomie):
[mediawiki/core@master] WebReponse: Use values altered in 'WebResponseSetCookie' hook

rMW23706be35c03: Disable WebResponse setters for post-send processing broke the WebResponseSetCookie hook's ability to alter the cookie being set, which broke the mobile hack for T49647: user login doesn't work, so it was trying to set the CentralAuth cookies with instead of

"Maybe this is irrelevant, maybe this is the cause, but as I saw that you wish to fix this bug, with me this bug first started I think two weeks ago and during that time I received a message from Tech News that no new build will be rolled out that week, I'm not sure if we're on the same build of the MediaWiki software as we were two (2) weeks ago, could it maybe be true that this problem is exclusive to this build? And if possible, could you compare the cookies between the (particularly mobile) features of the current build and the preceding build? For the record as far as I know this only affects, as you can see I'm editing "on mobile" on the English Wikipedia (URL string: here without any logging issues, so maybe you could also compare the cookies of both wiki's. --[[User:Donald Trung|Donald Trung]] ([[User talk:Donald Trung|talk]]) 19:47, 8 July 2018 (UTC)
: This talk page is not a good place for this. It belongs "

Copied this from

See and for general info.
I don't understand why it matters if it's exclusive to this build, or whose 'cookies' to compare as only you have your cookies on your computer...

User:GerifalteDelSabana seems to suffer from it too, please see:

So this issue keeps affecting more users as time progresses.

Change 444464 merged by jenkins-bot:
[mediawiki/core@master] WebReponse: Use values altered in 'WebResponseSetCookie' hook

Anomie claimed this task.

Unless someone backports it, the fix should be deployed with 1.32.0-wmf.13 or later. That should be Wednesday, July 18.

If someone wants it backported, see for instructions on making that happen. Anyone can request the backport if they can follow the directions there; the primary requirement is that you be on the Freenode IRC channel mentioned there during the window. The next backport window is today at 23:00โ€“00:00 UTC (a bit over 3 hours from now), and after that the next window is Monday morning at 11:00โ€“12:00 UTC.

If I wasn't going to be flying all day Monday, I would backport and deploy this. I'm honestly tempted to deploy it today even though it's Friday. @phuedx, anyone from your team want to SWAT deploy this on Monday?

kaldari renamed this task from Can't log into mobile on Commons, while I remain logged into the desktop version to Can't log into mobile on Commons.Jul 13 2018, 6:52 PM

Change 445957 had a related patch set uploaded (by Phuedx; owner: Anomie):
[mediawiki/core@wmf/1.32.0-wmf.12] WebReponse: Use values altered in 'WebResponseSetCookie' hook

I've scheduled โ˜๏ธ for deployment during today's European Mid-day SWAT deployment.

Change 445957 merged by jenkins-bot:
[mediawiki/core@wmf/1.32.0-wmf.12] WebReponse: Use values altered in 'WebResponseSetCookie' hook

Mentioned in SAL (#wikimedia-operations) [2018-07-16T11:36:43Z] <pmiazga@deploy1001> Synchronized php-1.32.0-wmf.12/includes/WebResponse.php: SWAT: [[gerrit:445957|WebReponse: Use values altered in WebResponseSetCookie hook (T198525)]] (duration: 00m 54s)

Thanks to @pmiazga for deploying the change in my (unexpected!) absence.

I can now login to and when I do I see the CentralAuth cookies being set with a domain of ๐Ÿ‘

Confirmed that this is fixed. Thanks @Anomie, @phuedx, and @pmiazga !

Change 615875 had a related patch set uploaded (by Reedy; owner: Anomie):
[mediawiki/core@REL1_31] WebReponse: Use values altered in 'WebResponseSetCookie' hook

Change 615875 merged by jenkins-bot:
[mediawiki/core@REL1_31] WebReponse: Use values altered in 'WebResponseSetCookie' hook