Hi, I have been investigating this matter, blocking an IP address from my admin account and I can confirm that "blocked user, even after logging out and moving to a new IP address, will still be blocked" on my local instance and on beta.

A wikiBlockID cookie remains as I change my IP address.

I notice that when I log in to a different account, the cookie is gone.
I also notice when I log out from this account, the cookie does not reappear when visiting the website even though I'm still using the blocked IP address.

It reappears when I try to edit a page.

@AGueyte Thanks - this sounds like the correct behaviour. Just to confirm, does the cookie get added in both the following situations?

• When blocking an IP address with CookieSetOnIpBlock true
• When auto-blocking a user account (i.e. with Automatically block the last IP address used by this user[...] checked) with CookieSetOnAutoblock true

Also, would it be possible to double-check that it's not possible to edit while the cookie is set?

@Ladsgroup I think you suspected cookie blocks may not be working. Was there something in particular that you thought might be wrong?

Thanks. I actually think I now know what I thought is missing.

We have lots of returning vandals who come back under a new username when we block their accounts indefinitely and I want them to stay blocked but it seems they simply create a new account and come back. Unless I misunderstanding this:

I notice that when I log in to a different account, the cookie is gone.

I highly think autoblock must block thee user that tries to login with a new account. For complicated cases of shared devices, it's either WP:MEAT and they should stay blocked or we can unblock the block # (something we do with IPs quite often and it's by design more of problem in IPs than shared devices).

Do you think it would be possible to implement that? I can write pages explaining why this is important.

Confirming the blockID cookie showing up when
When blocking an IP address with CookieSetOnIpBlock true
When auto-blocking a user account (i.e. with Automatically block the last IP address used by this user[...] checked) with CookieSetOnAutoblock true

Scenario:
From my admin account AGueyte, I blocked IP Address 90.132.88.33, an IP that I'm currently using, and checked the box to block all users from this IP address
The moment I'm blocking it, my cookies change from:

As I log out of my admin account AGueyte and am visting to the Special:Log page from the blocked IP 90.132.88.33, the blockID cookie shows.

Confirming that I cannot edit any pages on that blocked IP address

As I log in to another account, TorontoTest, my blockID cookie disappears but I still cannot edit a page, I still use the same IP Address.

If I empty my cookie from my Chrome settings, I'm automatically logged out but my blockID cookie is showing up again as I'm back onto the blocked IPaddress and I cannot make an edit.

Let me know if you'd like me to explore another scenario!
Thank you

In T309625#7996939, @Ladsgroup wrote:

Thanks. I actually think I now know what I thought is missing.

We have lots of returning vandals who come back under a new username when we block their accounts indefinitely and I want them to stay blocked but it seems they simply create a new account and come back. Unless I misunderstanding this:

I notice that when I log in to a different account, the cookie is gone.

I highly think autoblock must block thee user that tries to login with a new account. For complicated cases of shared devices, it's either WP:MEAT and they should stay blocked or we can unblock the block # (something we do with IPs quite often and it's by design more of problem in IPs than shared devices).

Do you think it would be possible to implement that? I can write pages explaining why this is important.

@Ladsgroup Thanks for clarifying. If a user is autoblocked with account creation disabled, this should prevent them from creating an account from any of the autoblocked IP addresses (I just tested that this works locally). However, autoblocks only last for one day. Could that be the problem?

Pinging @Niharika too since we seem to be discussing a new feature request potentially.

Moving this to Done for the purposes of investigating wither cookie blocks are working - thanks @AGueyte

Thanks for the investigation @AGueyte and @Tchanders.

@Ladsgroup the idea makes sense to me but I think we should run it by the community before making this change as it will be effectively invisible in the interface. I don't want to assume this seems obvious to everyone. Can you please file a ticket for requesting this feature? I'll see what I can do about kick starting a community discussion. Thanks!

In T309625#8104591, @Niharika wrote:

@Ladsgroup the idea makes sense to me but I think we should run it by the community before making this change as it will be effectively invisible in the interface. I don't want to assume this seems obvious to everyone. Can you please file a ticket for requesting this feature? I'll see what I can do about kick starting a community discussion. Thanks!

Sure thing 🎉

T314174: Expand cookie blocking to enforce existing blocks with the same duration