@Jdlrobson any plan to fix this?

@Matanya this is the first time I've seen this ticket.

I am not familiar with CentralAuth and It looks like this extension is unmaintained https://www.mediawiki.org/wiki/Developers/Maintainers so unfortunately at the current time, probably no team is looking at this.

See also T252244 (:-()

@Jdlrobson you triaged this two years ago :)

Thanks for your comment, I was quite sure this is a UI problem, and not a real problem in the extension. If it is in the extension, well - I lost hope here. Maybe if I will add this to the steward board it might be picked up one day.

@Matanya so I did. I presume the issue is somewhere inside the CentralAuth code, or perhaps the varnish layer? I wouldn't know where to start though. Sorry I can't be more help :-(

As a stab in the dark, I notice none of the CentralAuth ResourceLoader modules set redirect code, so perhaps that needs to be loaded (related T235712)?

"targets": [
                               "mobile",
                               "desktop"
                       ]

I can (mostly) replicate this on the beta cluster, though this is using a desktop PC and "forcing" the use of the mobile domain:

• Directly visit a mobile site CentralAuth link (e.g. https://meta.m.wikimedia.beta.wmflabs.org/wiki/Special:CentralAuth?target=TNTBot) or visit https://meta.m.wikimedia.beta.wmflabs.org/wiki/Special:CentralAuth and enter a username
• Select the appropriate radiobutton to lock the account, and enter a reason

• Click "Set status"
• You are redirected to the desktop version of the site, and presented with the error Sorry, we could not process your form submission due to a loss of session data.

• The account is not locked

@pmiazga reached out to me about this task. I tried it out, and the result is available as https://people.wikimedia.org/~urbanecm/screencasts/T256185.webm. It seems to work now (likely because we have now removed the .m. domain).

@TheresNoTime, in case you can reproduce this still somehow.