Page MenuHomePhabricator

[Investigate] Autoblocks behavior for temporary accounts
Closed, ResolvedPublic

Description

Motivation

For the MVP of IP Masking, we want to implement Autoblocks for temporary accounts similar to how they work for registered users.

Spec
  • Ensure that autoblock behavior for temporary accounts works as follows: Automatically block the last IP address used by this user, and any subsequent IP addresses they try to edit from, for a period of 1 day

Event Timeline

Hi, this is what I have witnessed

Test 1 | Temporary User
In window A, I have a temporary user, *Unregistered 15, making edits with 3 different IPs.
In window B, with my admin account, I block *Unregistered 15 and keep "Automatically block the last IP address used by this user, and any subsequent IP addresses they try to edit from, for a period of 1 day" checked.
The form displays: This is a temporary user using the following IPs: 240.175.34.103, 138.244.92.249, 147.243.123.0 and 152.215.71.138
The autoblock is created and visible in BlockList.

In window A, logged out from *Unregistered 15, I attempt to make edits with the 3 IPs used by the temp user.
Only one IP returns an autoblock error message (autoblock because *Unregistered 15 used this IP): the first IP used by this temp user 240.175.34.103.
There is no autoblock on 147.243.123.0 and 152.215.71.138.

Test 2 | Registered User
In window A, with a registered user VancouverTest, I make multiple edits with 2 different IPs.
In window B, with my admin account, I block VancouverTest and keep "Automatically block the last IP address used by this user, and any subsequent IP addresses they try to edit from, for a period of 1 day" checked.
The autoblock is created and visible in BlockList.

In window A, logged out from VancouverTest, I attempt to make edits with the 2 IPs used previously by the registered user.
Only the latest IP used shows an autoblock message (autoblock because VancouverTest used this IP). The first IP used doesn't have an autoblock and allowed me to create a new temp user while saving the edit.

I have a question regarding the phrasing of "Automatically block the last IP address used by this user, and any subsequent IP addresses they try to edit from, for a period of 1 day"

"Automatically block the last IP address used by this user"

This is happening correctly

"and any subsequent IP addresses they try to edit from"

My understanding is that all IPs used by the blocked user that we know of should have an autoblock.
But both my temp and registered users, once logged out, in window A and without cleaning cookies/caches, etc, were able to make edits with different IPs, and even create a temp user.

  • Is this the behavior we expect?
  • And what do we mean by "and any subsequent IP addresses they try to edit from"?

As for the investigation, the autoblock works the same for registered users and temporary users.

Tchanders subscribed.

Thanks @AGueyte

Only one IP returns an autoblock error message (autoblock because *Unregistered 15 used this IP): the first IP used by this temp user 240.175.34.103.

Just a small clarification - the first IP in the list is the most recently used, since the list is in reverse chronological order. So this is correct behaviour.

  • Is this the behavior we expect?

Yes, this is correct - there should only be an autoblock against the last IP used by the user

  • And what do we mean by "and any subsequent IP addresses they try to edit from"?

The blocked user (logged in to their account) switches IP address, and attempts to edit again. This should trigger an autoblock to be made against this new IP address. I confirmed this works for named users and temporary users by doing the following:

  1. Block a named/temp user, with the autoblock option checked
  2. While logged in as the user (or while still using the temp user's session), switch IPs and attempt to make an API edit
  3. The API edit is unsuccessful and the new IP address has a new autoblock
  4. Confirm that the IP address is blocked by logging out (or ending the session) and attempting to edit from it. (Unsuccessful, see autoblock message.)

In summary, this all looks fine to me. Will leave open for @Niharika to look over.

This comment was removed by Tchanders.

This looks fine to me. I have captured this in the documentation on office wiki page so we have it at hand when we elaborate it for the communities.