This seems weird - the URL is /wiki/Special:UserLogin and it must be a POST request since otherwise the code path that leads to continuePrimaryAuthentication() wouldn't be active, but the referrer is https://commons.m.wikimedia.org/wiki/Special:ConfirmEmail/517c09033f0a5ce67a12cdeacc68acc1. How is that even possible?

CentralAuthRedirectingPrimaryAuthenticationProvider::beginPrimaryAuthentication() returns a response with a CentralAuthReturnRequest object in it, in theory that means the following continuePrimaryAuthentication() call should also have that object. But maybe if the corresponding GET/POST parameter is missing, we automatically skip adding the object? I thought that would only happen to AuthenticationRequest objects where $required is set to OPTIONAL, but maybe I'm misremembering.

So I suspect this is some kind of manual request tampering, but in theory the LogicException should not be reachable, and if it is reachable, we need a proper StatusValue-based error instead.

There are maybe a dozen instances of this BTW - logstash.

This seems really weird, vaguely following the Special:ConfirmEmail code, I see that it sometimes call Special:UserLogin as a GET request. I think maybe this is when we some weird behavior when cookies on shared domain are set but not on local domain (when continueAuthentication is called) - maybe some timeout(?). Then that throws the logic error but I wonder why/when that should ever happen.

But nevertheless, I'll try to reproduce it and see.

I guess what's happening is:

• login or signup succeeds on the shared domain and redirects the user to Special:UserLogin/return on the local domain
• AuthManagerSpecialPage::handleReturnBeforeExecute() sets the session key for handling this request as a POST, and redirects to Special:UserLogin
• for some reason that redirect doesn't work, or maybe there is just a race between it and the user using another browser tab
• the user clicks on the link in the confirmation email, gets sent to the login page, but since they still have the session cookie and the session has the special key, AuthManagerSpecialPage thinks this is the last step of remote authentication, and should be interpreted as a form submit. But the URL parameter that would be used for CentralAuthReturnRequest is not actually there.

We should probably use a query parameter to ensure that the special /return processing only happens on the same redirect chain, and not in an unrelated browser window.

There's also a bunch of Validation error on return logstash entries, which I imagine is a side effect of this, but we'll need to double-check that.

~150 cases in the last 7 days.

Change #1128039 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/core@master] authmanager: Use an URL parameter to keep track of returns

https://gerrit.wikimedia.org/r/1128039

Change #1128039 merged by jenkins-bot:

[mediawiki/core@master] authmanager: Use an URL parameter to keep track of returns

https://gerrit.wikimedia.org/r/1128039

Change #1130320 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/core@wmf/1.44.0-wmf.21] authmanager: Use an URL parameter to keep track of returns

https://gerrit.wikimedia.org/r/1130320

Change #1130320 merged by jenkins-bot:

[mediawiki/core@wmf/1.44.0-wmf.21] authmanager: Use an URL parameter to keep track of returns

https://gerrit.wikimedia.org/r/1130320

Mentioned in SAL (#wikimedia-operations) [2025-03-24T08:48:31Z] <tgr@deploy1003> Started scap sync-world: Backport for [[gerrit:1130320|authmanager: Use an URL parameter to keep track of returns (T388250)]]

Mentioned in SAL (#wikimedia-operations) [2025-03-24T08:54:01Z] <tgr@deploy1003> tgr: Backport for [[gerrit:1130320|authmanager: Use an URL parameter to keep track of returns (T388250)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2025-03-24T09:04:49Z] <tgr@deploy1003> Finished scap sync-world: Backport for [[gerrit:1130320|authmanager: Use an URL parameter to keep track of returns (T388250)]] (duration: 16m 18s)