Steps to reproduce (probably non-deterministic): log in and open https://www.wikidata.org/ and https://commons.wikimedia.org/ in two browser tabs. When you refresh one, your session is lost in the other (when you refresh there as well, you get an anonymous initial pageview and then the "You are centrally logged in..." notice when CentralAuth autologin kicks in).
Description
Description
Details
Details
Related Changes in Gerrit:
Customize query in gerrit
Related Objects
Related Objects
Event Timeline
Comment Actions
Possibly related to T299193: MediaWiki login failure due to race condition with session cookie which has been backported recently.
Comment Actions
There has been a spike of Failed to load session, unpersisting log events which clearly coincides with the backport:
Comment Actions
Change 801683 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/core@wmf/1.39.0-wmf.13] Revert "Tombstone the old session on SessionBackend::resetId()"
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2022-05-31T14:19:04Z] <tgr> doing an emergency revert for T309616
Comment Actions
Change 801683 merged by jenkins-bot:
[mediawiki/core@wmf/1.39.0-wmf.13] Revert "Tombstone the old session on SessionBackend::resetId()"
Comment Actions
The revert helped. I'm not really sure what happened. I noticed the normal session cookie and the legacy SameSite session cookie (ss0-*) having a different value, so maybe it's due cross-domain AJAX requests where the browser only sends one of those cookies and it gets changed but the other doesn't?
(Although some people say they could reproduce this with two tabs on the same site, and SameSite cookies wouldn't have any special behavior there.)
Comment Actions
Change 801748 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/core@wmf/1.39.0-wmf.14] Revert "Tombstone the old session on SessionBackend::resetId()"
Comment Actions
Change 801749 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/core@master] Revert "Tombstone the old session on SessionBackend::resetId()"
Comment Actions
Change 801748 merged by jenkins-bot:
[mediawiki/core@wmf/1.39.0-wmf.14] Revert "Tombstone the old session on SessionBackend::resetId()"
Comment Actions
Change 801749 merged by jenkins-bot:
[mediawiki/core@master] Revert "Tombstone the old session on SessionBackend::resetId()"
Comment Actions
Here are some relevant log frequencies - the patch was deployed at 11:01 UTC on Tuesday and undeployed at 14:46, I think? (It did not get logged in SAL or here for some reason, and my IRC bouncer's clock is way off).
| channel | message | graph |
| session | Persisting session due to no pre-existing stored session |  |
| session | Persisting session for unknown reason |  |
| session | Persisting session for renewal |  |
| session | Failed to load session, unpersisting |  |
| session | Session "{session}": Metadata merge failed: Key "CentralAuthSource" changed |  |
| session | Session "{session}": Unverified user provided and no metadata to auth it |  |
| session | Session "{session}": Metadata has an anonymous user, but a non-anon user was provided |  |
| authentication | Login for {user} succeeded from {clientip} |  |
Most of these are normal side effects of the session churn. I'm not sure what to make of the Metadata has an anonymous user, but a non-anon user was provided one, or the drop in Persisting session due to no pre-existing stored session is probably