- Open https://wikitech.wikimedia.org/wiki/Main_Page
- Then https://wikitech.wikimedia.org/w/index.php?title=Special:UserLogin&returnto=Main+Page&usesul3=1 (which simulates clicking "Log in" with SUL3 enabled). This redirects to https://auth.wikimedia.org/labswiki/w/index.php?title=Special:UserLogin&returnto=Main_Page¢ralauthLoginToken=***&usesul3=1&useformat=desktop
- Enter credentials for KrinkleSock (regular account; no admin rights, not bot rights, no staff rights, no 2FA)
Actual
There is a "Session hijacking" error, which I believe internally means that cookies were seemingly lost or not set.
Other
I found this because I was trying to log in on Wikitech from my phone. Even though my account has not opted-in to SUL3, and Wikitech is not in group0, I ended up here because I accidentally clicked "Create account" (which is now 100% sampled into SUL3) and from there I switched to "Log in".
I considered it might be 2FA related as I first encountered it with my main account. I confirmed it with my KrinkleSock alt, which does not use 2FA.
I considered it might be due to conflict between the session created for the "Create account" form. This should not be a problem, but to rule it out I confirmed it also fails in the simpler scenario of correctly going to "Log in" directly.
This issue does not happen in Firefox or Chrome and appears to be specific to Safari. I confirmed it in:
- Firefox on iOS 18.3 (which is Mobile Safari underneath, given that it is on iOS)
- Mobile Safari on iOS 18.3.
- Safari 18.3 on macOS 15 (desktop).