Page MenuHomePhabricator

MediaWiki logout request succeeds before web browser's "Leave this page?" dialog has been answered
Open, Needs TriagePublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

  • Visit https://en.wikipedia.org/w/index.php?title=Wiki&action=edit while being logged in into wikipedia account (make sure you visit in dekstop view)
  • Write some random characters into the article (do not click "submit")
  • Tap on "Log out" in top right
  • In the opening window, tap on "STAY"
  • Open a new tab and open en.wikipedia.org there

What happens?:
User gets logged out

What should have happened instead?:
User should stay logged in when selecting "STAY", the "Log out" command should not be submitted if user selects "STAY"

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):

Other information (browser name/version, screenshots, etc.):
Chrome, Firefox and others. Videos of reproducing: https://bugzilla.mozilla.org/show_bug.cgi?id=1924136#c5

Event Timeline

That "opening window" is provided by your web browser. I'm not sure if anything can be done on the Wikimedia site when your web browser tries to outsmart you while not understanding what is actually going on. If your web browser wants to stop Wikimedia from performing the logout request, then your web browser is free to try to block that request.

Aklapper renamed this task from on Android, logout request is submitted before the "leave this site?"-prompt is displayed to MediaWiki logout request succeeds before web browser's "Leave this page?" dialog has been answered.Mar 6 2025, 1:30 PM
Tgr subscribed.

Pretty sure this is a bug. Probably the beforeunload event is getting triggered when clicking on logout (even though it should disable the default navigation behavior and make an AJAX request instead).

A_smart_kitten subscribed.

From watching the linked screen recording, my immediate guess as to what might be happening here is:

  • Tapping the ‘log out’ link appears to result in the user being logged-out in the background (i.e., while they’re on the same page).
  • After having logged the user out in the background, MediaWiki then appears to try to redirect the user to a ‘you have been logged out’ page.
  • Because the user has made changes in the editor, another part of MediaWiki might then trigger the browser warning of ‘do you want to leave this page?’.
  • Tapping ‘stay’ might prevent the user from being redirected to a ‘you have been logged out’ page. However, because (at this point) the user may have already been logged-out in the background, it might not prevent the logging-out itself from taking place.

I should note that I haven’t looked at the source code that might be causing this behaviour - this is my guess purely based on having watched the screen recording, so it definitely isn't guaranteed to be correct!