Seems like a SessionManager bug - those sessions clearly don't have the same priority:

[b2fa3a34-b31a-4584-9900-06adcb3bde76] /w/rest.php/wikibase/v0/entities/lexemes/L1041834/senses   MediaWiki\Session\SessionOverflowException: Multiple sessions for this request tied for top priority: [100]MediaWiki\Extension\OAuth\SessionProvider<anon>h5cshtuck442udqpv2lsupnhp2u8buao, [50]CentralAuthSessionProvider<anon>rspba02td80u2kaju3teghvqm0tf11qi

But also, the priority of CentralAuthSessionProvider should be 11, not 50 (it's hardcoded). What's going on?

Seems like a one-off so far (logstash).

In T388172#10612015, @Tgr wrote:

Seems like a SessionManager bug - those sessions clearly don't have the same priority:

[b2fa3a34-b31a-4584-9900-06adcb3bde76] /w/rest.php/wikibase/v0/entities/lexemes/L1041834/senses   MediaWiki\Session\SessionOverflowException: Multiple sessions for this request tied for top priority: [100]MediaWiki\Extension\OAuth\SessionProvider<anon>h5cshtuck442udqpv2lsupnhp2u8buao, [50]CentralAuthSessionProvider<anon>rspba02td80u2kaju3teghvqm0tf11qi

But also, the priority of CentralAuthSessionProvider should be 11, not 50 (it's hardcoded). What's going on?

CentralAuthSessionProvider priority is hardcoded to 50 in extension.json, are my missing something?

Seems like a one-off so far (logstash).

This seems to be coming from the REST API, not sure if that means anything but yes SessionManager is a culprit here.

In T388172#10612843, @DAlangi_WMF wrote:

CentralAuthSessionProvider priority is hardcoded to 50 in extension.json, are my missing something?

No, I was looking at the wrong class.

I can think of two things:

• Someone made a REST API request with both an OAuth access token and a CentralAuth cookie, and that triggered this error, despite the OAuth session provider clearly having higher priority. That would be bad (but I feel we'd know about it already, having two kinds of session information on a request can be common).
• Someone made a REST API request with both an OAuth access token and a CentralAuth token (which both have max priority), and SessionManager correctly threw an exception, but for some reason it indicated the wrong session provider as the culprit (maybe because the request had a CentralAuth cookie as well). That would be a relatively minor issue.

The relevant logic in getSessionInfoForRequest() seems solid, I have no idea how this could be happening.

Couple more for reference...

Error

• mwversion: 1.44.0-wmf.19
• reqId: 29a7376a-792e-43db-a5d6-2b3fee026a40
• Find reqId in Logstash

[{reqId}] {exception_url}   MediaWiki\Session\SessionOverflowException: Multiple sessions for this request tied for top priority: [100]MediaWiki\Extension\OAuth\SessionProvider<anon>h5cshtuck442udqpv2lsupnhp2u8buao, [50]CentralAuthSessionProvider<anon>ch5

Impact

Notes

Error

• mwversion: 1.44.0-wmf.19
• reqId: b38f56a8-129e-4e11-b6a9-58680a004c23
• Find reqId in Logstash

[{reqId}] {exception_url}   MediaWiki\Session\SessionOverflowException: Multiple sessions for this request tied for top priority: [100]MediaWiki\Extension\OAuth\SessionProvider<anon>h5cshtuck442udqpv2lsupnhp2u8buao, [50]CentralAuthSessionProvider<anon>nck

Impact

Notes

FWIW these are all anonymous sessions, which means OAuth would throw an exception anyway if this error wouldn't preempt it (although that would be a user-friendlier one). So I doubt there's any user impact. Still disturbing that this is possible at all, though.