Page MenuHomePhabricator

BotPasswords + Toolforge combination causing daily "login from new device" warning emails
Closed, DuplicatePublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

  • create an account (e.g. NovemBot)
  • create a bot password (e.g. NovemBot@Task_1)
  • set up a bot on Toolforge to use the bot password
  • set up a cron job to run the bot every half hour

What happens?:

  • 3 notifications emails per day with the subject line "Login to Wikipedia as NovemBot from a device you have not recently used"

What should have happened instead?:

  • no notification emails

Software version (skip for WMF-hosted wikis like Wikipedia):

Other information (browser name/version, screenshots, etc.):

  • Even if working as designed, suggest fixing to reduce spam and banner blindness.
  • Possible change to loginnotify code recently that might have caused this?
  • Two of my bots use the same BotPassword. A third bot has its own BotPassword.
  • The timestamps in the emails suggest that these are just bots following their normal cron jobs, and not unauthorized users. 05, 22, and 52 are times specified in my cronjob .yaml files.

image.png (447×410 px, 17 KB)

image.png (662×1 px, 47 KB)

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Possible change to loginnotify code recently that might have caused this?

That would probably be fixing LoginNotify: T344785: LoginNotify fully broken since January 2023


This is a duplicate of the long-standing T182867. I'm going to merge, but here's some things you can do now that will help:

  • Disable the emails in your preferences ("Login from an unfamiliar device")
  • Use cookies to prevent your bot from having to login on every run
  • Switch to OAuth2