I logged into my account on fawiki yesterday and my last edit was 2:53 AM UTC of February 3. Since I have higher privileges in fawiki, I never use the "keep me signed in" option. I did not explicitly log out, but left my browser window unattended for approximately 22 hours. When I came back, I refresh the window (which was showing a fawiki page). The page refreshed successfully, and I noticed that I have 3 alerts and 2 notices; the yellow "new message" box also appeared.
If I understand the MW session configurations at WMF correctly, my session must have expired by the time I came back. Therefore, even on the first refresh, I should not have been considered logged in, therefore, I should not have seen my notifications or the yellow talk page message. I am guessing some kind of cache was involved in this. Therefore, I refreshed the page. This time, it was shown to me in logged-out form.
I believe something is wrong here. If I was still logged in (which I should not have been) then the session should have been rejuvenated upon the first refresh and I should have remained logged in for the second refresh too, no? And if I indeed was logged out, then why did the first refresh show me the notifications? Of note, when I logged in later, the notification counts were exactly what I had seen after first refresh.
Could there be a cache-related security issue here?
The obvious challenge with this task: it is hardly reproducible.
PS: I remember this happened to me once before, several months ago. At the time, I assumed that I was confused and dismissed it. But that incident made me pay closer attention this time.