The logout link on Special::UserLogout doesn't respect mobile domain
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	DIKW_Pyramid
	Jun 16 2019, 7:35 AM

Description

It is not possible to logout from mobile wiki via Special::UserLogout page

Reproduction steps

Login to Wikipedia
Switch To mobile view
Go to LogoutPage (https://en.m.wikipedia.org/wiki/Special:UserLogout)
Click the continue to the log out page link

Expected result: user gets logged out
Current result: MediaWiki UserLogout page shows an error "Log out failed due to session error. Please try again."

Developer notes

This happens when the link to the Special::UserLogout page doesn't contain the logoutToken, then the Mobile Wikipedia shows an intermediate step - it asks for confirmation.
The continue to the log out page link points to the desktop (https://en.wikipedia.org/wiki/Special:UserLogout) UserLogout page, but user is on mobile domain. Most probably because of that
the token is invalid

Related Objects

Mentioned In: T214998: RFC: Serve mobile and desktop variants through the same URL (unified mobile routing)
Mentioned Here: T232734: Mobile logout should not involve an interstitial
T156847: Core should be aware of the domain it is running on and render mobile domains where necessary
T25227: Use token when logging out
T225220: Don't show intermediate step during log out action on the MinervaNeue skin

Event Timeline

DIKW_Pyramid created this task.Jun 16 2019, 7:35 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 16 2019, 7:35 AM

DIKW_Pyramid edited projects, added MobileFrontend; removed MobileFrontend (MobileFrontend Special Pages).Jun 17 2019, 8:58 PM

DIKW_Pyramid updated the task description. (Show Details)

From my point of view, - this is high priority bug, and sometimes it related to security.

@DIKW_Pyramid: In the mobile view I choose the logout icon and I end up on the page "Log out - If you wish to log out please continue to the log out page". After clicking that link I get "You are now logged out." so I can successfully log out.

It is unclear to me what the exact bug is in this task, and what does not work for you. Please clarify. If "logout is not possible.", please explain why it is not possible.

(Also resetting priority; see https://www.mediawiki.org/wiki/Phabricator/Project_management#Setting_task_priorities )

@DIKW_Pyramid - the logout link on the MainMenu doesn't specify the domain, it shows only relative link to the Special:UserLogout page.

Are you asking about the intermediate step:

If yes, this is currently fixed in T225220: Don't show intermediate step during log out action on the MinervaNeue skin, we stopped showing the intermediate step, and the link on the Logout menu will work properly.

But definitely I see there is an error in the Special::LogoutUser page, that doesn't respect the mobile domain.

@Aklapper I think I know what's the issue, the Special:LogoutPage doesn't respect the mobile domain, it creates the logout link that points to the desktop wikipedia site.

Some time ago, we started adding a logoutToken to the logout link T25227: Use token when logging out, but Minerva skin didn't get that fix, only core. Therefore, Minerva logout shows the desktop Special::UserLogout page and ask for log out confirmation.

I'll edit description, and leave reproduction steps

pmiazga renamed this task from It is not possible to logout from wiki if mobile view is enabled and mobile wiki has separate domain to The logout link on Special::UserLogout doesn't respect mobile domain.Jun 18 2019, 3:44 PM

pmiazga changed the task status from Stalled to Open.

pmiazga updated the task description. (Show Details)

pmiazga added a project: Web-Team-Backlog-Archived (Tracking).

DIKW_Pyramid merged a task: Restricted Task.Jun 18 2019, 5:00 PM

In T225879#5265902, @pmiazga wrote:

@Aklapper I think I know what's the issue, the Special:LogoutPage doesn't respect the mobile domain, it creates the logout link that points to the desktop wikipedia site.

Yes, exactly! And logout from mobile domain is not possible.

Some time ago, we started adding a logoutToken to the logout link T25227: Use token when logging out, but Minerva skin didn't get that fix, only core. Therefore, Minerva logout shows the desktop Special::UserLogout page and ask for log out confirmation.

Confirmation page is not problem.

Problem that you can't logout at all - en.wikipedia.org only show error message "Log out failed due to session error. Please try again." instead of logout from en.m.wikipedia.org.

I think this is the same problem as T156847 ?

Is this still valid? This is how the confirmation page looks now:

mobile logout interstitial.png (949×1 px, 36 KB)

and it works fine for me:

mobile logout success.png (949×1 px, 78 KB)

(IMO the confirmation page shouldn't be normally shown to the user. Filed T232734: Mobile logout should not involve an interstitial about that.)

In T225879#5487457, @Tgr wrote:

Is this still valid? This is how the confirmation page looks now:

and it works fine for me:

@Tgr, you are right, this issue is now fixed on https://en.m.wikipedia.org/ site. Thank you!

Krinkle mentioned this in T214998: RFC: Serve mobile and desktop variants through the same URL (unified mobile routing).Dec 11 2024, 10:17 AM

	F30308121: mobile logout interstitial.png
	Sep 12 2019, 12:01 PM

	F29602728: image.png
	Jun 18 2019, 3:32 PM

The logout link on Special::UserLogout doesn't respect mobile domainClosed, ResolvedPublicActions