Page MenuHomePhabricator
Create Task
Maniphest T33355

Logging out from "https" wikis shouldn't log out from "http"
Closed, DeclinedPublic
Actions

Description

If I go to
https://www.mediawiki.org/w/index.php?title=Special:UserLogin
and mark the options
[x]Also log me in to other wikis of the Wikimedia Foundation
[x]Remember my login on this browser (for a maximum of 30 days)
I'll be logged in on https://www.mediawiki.org but NOT on http://www.mediawiki.org

If I go then to
http://www.mediawiki.org/w/index.php?title=Special:UserLogin
and log in using the same account, I'll be now logged on both http and https.

So far so good, but if I go to
https://www.mediawiki.org/w/index.php?title=Special:UserLogout
then what I would expect from the login proccess is to be logged out ONLY from https, but currently this is not the case and I'll be logged out from both http and https.

Could someone take a look into this?

Version: unspecified
Severity: normal

Details

Reference
bz31355

Related Objects
Search...

Event Timeline

• bzimport raised the priority of this task from to Needs Triage.Nov 21 2014, 11:55 PM
• bzimport added a project: MediaWiki-User-login-and-signup.
• bzimport set Reference to bz31355.
• bzimport added a subscriber: Unknown Object (MLST).
He7d3r created this task.Oct 4 2011, 8:15 PM
He7d3r added a comment.Oct 4 2011, 8:17 PM

(In reply to comment #0)

and mark the options
[x]Also log me in to other wikis of the Wikimedia Foundation
[x]Remember my login on this browser (for a maximum of 30 days)

The problem also happens if I log without marking any of these options, so I don't think they make any difference.

Skalman added a comment.Oct 4 2011, 11:08 PM

This is expected behavior and on purpose.

It is only possible to be logged in using *one* account. Logging in with another will automatically log out the first one.

If you log in on HTTPS you don't want the session data to spill over an unsecure HTTP channel, which is why you aren't logged in there.

If you log in on HTTP you are okay with session data over an unsecure channel, but of course it's simpler if the login is available also over the secure channel.

Do you understand the idea?

Reedy added a comment.Oct 4 2011, 11:10 PM

This is how it works, and is how it's supposed to do.

Changing it to separate them is just daft

He7d3r added a comment.Oct 4 2011, 11:50 PM

Ok. I think I got it =)

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL