Thanks for reporting! Are you willing to do some debugging around this? If you could provide the exact timestamp for the last logged-in request and the first not-logged-in request, I could check if the logs contain anything useful.

Also can you check whether the cookie lifetime for the various authentication cookies (<wiki>Session, <wiki>UserName, centralauth_Session, centralauth_User) are 24+ hours as expected? And tell what browser you are using?

There are a number of things that could go wrong:

• Kask expiry (set correctly but who knows)
• SessionBackend::renew() doing something bad
• the browser restricting cookie lifetime as part of anti-tracking protections (e.g. Safari ITP or Firefox ETP)
• SessionManager deeming the session invalid for some non-expiry-related reason

In T387061#10576766, @Tgr wrote:

Thanks for reporting! Are you willing to do some debugging around this? If you could provide the exact timestamp for the last logged-in request and the first not-logged-in request, I could check if the logs contain anything useful.

Yes I am happy to. I will have to wait for it to occur again, but I will pay attention to collect the details this time and will securely share it with you.

In T387061#10576790, @Tgr wrote:

Also can you check whether the cookie lifetime for the various authentication cookies (<wiki>Session, <wiki>UserName, centralauth_Session, centralauth_User) are 24+ hours as expected? And tell what browser you are using?

Firefox on Mac. <wiki>Session and centralauth_Session have an expiry value of "Session" (i.e. no specific date and time). <wiki>UserName and <wiki>UserID and centralauth_User have an expiry that is approximately 32 days in the future.

@Tgr it happened again. I have provided some details in this private paste: P73705

Of note, the session ID I shared is likely a newly assigned session ID for my logged out state. There are non <wiki>Session, centralauth_Session, or centralauth_User keys in my cookies. The only key that exists is the <wiki>mwuser-sessionId which I referenced in that paste. If you need additional details, I can provide them within reason.

Ah, it gets more complicated! Note that I was logged out when I refreshed the page. I clicked the login link, and instead of going to the login page, it logged me in! This is different from the last time I had this experience (that time, clicking on the login link took me to the login form).

@Tgr it happened one again. This time, it didn't log me back in when I clicked on the login link. I had to properly login with my username and password. The duration of inactivity was only around 12 hours. I have updated P73705 accordingly.

It happened again. And similar to last time, it resulted in me having to log in again. Duration of inactivity was around somewhere between 12 and 13 hours in both of these cases.

FYI it keeps happening every few days, at random times.

The most extreme version of it happened today, when I made an edit and literally 10 minutes later, the wiki forced me to log in again. All I did was refresh the page in the tab that was open since my edits.