Page MenuHomePhabricator

No warning logged in Wikimedia production when CentralAuth tries to send headers after body
Open, Needs TriagePublicBUG REPORT

Description

I discovered this via T347889: Investigate why CentralAuth edge login fails in browsers that do not block third-party cookies; to test locally, I added setcookie('test', 1); to the end of SpecialCentralAutoLogin::doFinalOutput() and then loaded <loginwiki>/wiki/Special:CentralAutoLogin/start?type=1x1 (which results in an error). I get an ErrorException on the error channel with severity ERROR, with the message PHP Warning: Cannot modify header information - headers already sent by (output started at /vagrant/mediawiki/extensions/CentralAuth/includes/Special/SpecialCentralAutoLogin.php:780) which is expected behavior. Yet there are no errors like that in the production logs.

error_reporting() gives 30719 in shell.php which is E_ALL & ~E_STRICT, so warnings should be logged. At a glance, no production-deployed code seems to unset error reporting.

Event Timeline

Tgr renamed this task from No warning logged in CentralAuth when trying to send headers after body to No warning logged in Wikimedia production when CentralAuth tries to send headers after body.Oct 12 2023, 7:48 PM
thcipriani subscribed.

Removing "production error" since it's to track errors we're seeing in production (opposite of this :D) Tagging in SRE Observability in case there's something in the logging pipeline to investigate.

lmata subscribed.

Hi Folks, had an internal team discussion, and we dont think there is anything actionable on our end. Please re-tag if you have any follow-ups. Thanks!

I see this error in my local environment (PHP 8.1, Apache) and am confused as to 1) why we don't see this error logged in production and 2) why this doesn't cause more serious issues related to central login, as the console error (Uncaught SyntaxError: Unexpected token '<' (at checkLoggedIn?type=script&wikiid=enwiki:2:223)) indicates that checkLoggedIn JavaScript doesn't run successfully.

I see this error in my local environment (PHP 8.1, Apache) and am confused as to 1) why we don't see this error logged in production and 2) why this doesn't cause more serious issues related to central login, as the console error (Uncaught SyntaxError: Unexpected token '<' (at checkLoggedIn?type=script&wikiid=enwiki:2:223)) indicates that checkLoggedIn JavaScript doesn't run successfully.

Filed that specific error as T364116: checkLoggedIn script fails with headers already sent error

I suspect whether the error is happening at all depends on MediaWiki and/or Apache output buffering config (e.g. $wgDisableOutputCompression, mod_deflate). But T347889 was happening in production (it broke central autologin), it just did not get logged.