Page MenuHomePhabricator
Create Task
Maniphest T390847

Unsuccessful central autologin is creating an anonymous session
Closed, InvalidPublicBUG REPORT
Actions

Description

Visit a wiki page in a fresh browser tab (no cookies etc). It will do central autologin, e.g.

  • https://en.wikipedia.org/wiki/Main_Page AJAX ->
  • https://en.wikipedia.org/wiki/Special:CentralAutoLogin/start?type=script&usesul3=0 302 ->
  • https://login.wikimedia.org/wiki/Special:CentralAutoLogin/checkLoggedIn?useformat=desktop&wikiid=enwiki&usesul3=0&type=script 302 ->
  • https://auth.wikimedia.org/loginwiki/wiki/Special:CentralAutoLogin/checkLoggedIn?useformat=desktop&wikiid=enwiki&usesul3=1&triedSul3Fallback=1&type=script 200 with a JS snippet to set cookie to prevent further autologins

That last step will create an anonymous session (there's a `set-cookie:
authSession=...` header on the response). That's not supposed to happen, and is unsustainable as every anonymous visitor is sent through this route.

Related Objects

Event Timeline

Tgr created this task.Apr 2 2025, 11:41 AM
Restricted Application added a project: MediaWiki-Core-Platform-Team. · View Herald TranscriptApr 2 2025, 11:41 AM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript
Tgr triaged this task as Unbreak Now! priority.Apr 2 2025, 11:41 AM
MBH subscribed.Apr 2 2025, 11:45 AM
• DAlangi_WMF subscribed.EditedApr 2 2025, 12:16 PM

On enwiki (in prod), I can reproduce this by checking the dev tools and saw an anon session created but can't reproduce this locally.

I wonder why this is even happening in the first place. I thought an anon session can be created at the very least only when we visit the Special:UserLogin page? Nevertheless, still digging to see if I can reproduce this locally.

Tgr added a comment.Apr 2 2025, 12:21 PM

I can't reproduce this anymore :( and looking at the code it seems strictly impossible. Maybe I just had too many browser windows open, and accidentally kept an incognito session open in the background so what I was testing with wasn't actually a fresh browser tab?

If this happened on every anonymous visit, it'd have a much bigger impact on the infrastructure than what we are seeing. And since it's about anonymous visits, there isn't much state that could make it nondeterministic. So I think this might have been me messing up the testing. Will do a couple more tries, then close as invalid if I still reproduce.

Tgr added a comment.Apr 2 2025, 12:26 PM
In T390847#10703397, @DAlangi_WMF wrote:

I thought an anon session can be created at the very least only when we visit the Special:UserLogin page?

Yeah there isn't anything in /checkLoggedIn that would persist the session, as far as I can see.

I think what could have happened is that I already had a session on that domain from previous testing, failed to properly reset the browser (incognito mode in Chrome discards all state when you close all incognito windows but not when one is open in the background), and the visit triggered some generic reason to write a session cookie, probably session renewal due to it being close to expiry.

Krinkle subscribed.Apr 2 2025, 3:36 PM
Tgr added a comment.Apr 2 2025, 5:14 PM

Looked up the relevant request in the logs (interestingly, the URL differs slightly in query parameter order: /loginwiki/wiki/Special:CentralAutoLogin/checkLoggedIn?triedSul3Fallback=1&type=script&useformat=desktop&usesul3=1&wikiid=enwiki - no idea what's up with that). It says Persisting session due to no pre-existing stored session, user is anonymous. Timestamp is 11:33:00.178.

hive (wmf_raw)> /* T390847 */ select dt, cache_status, http_status, http_method,uri_host, uri_path, uri_query, x_analytics from webrequest where ip = "<redacted>" and uri_host = 'auth.wikimedia.org' and uri_path like '/loginwiki/%' and  year = 2025 and month = 4 and day = 2 and hour = 11;

dt	cache_status	http_status	http_method	uri_host	uri_path	uri_query	x_analytics
2025-04-02T11:19:45Z	hit-front	200	GET	auth.wikimedia.org	/loginwiki/wiki/Special:CentralAutoLogin/checkLoggedIn	?useformat=desktop&wikiid=enwiki&usesul3=1&triedSul3Fallback=1&type=script	https=1;client_port=46570;nocookies=1
2025-04-02T11:19:59Z	miss	302	GET	auth.wikimedia.org	/loginwiki/wiki/Special:CentralAutoLogin/checkLoggedIn	?useformat=desktop&type=redirect&returnUrlToken=<redacted>&wikiid=enwiki&usesul3=1&useformat=desktop	https=1;client_port=34438;nocookies=1
2025-04-02T11:33:00Z	pass	200	GET	auth.wikimedia.org	/loginwiki/wiki/Special:CentralAutoLogin/checkLoggedIn	?useformat=desktop&wikiid=enwiki&usesul3=1&triedSul3Fallback=1&type=script	https=1;client_port=49992;sessioncookie=1

So, yes, PEBKAC issue.

Tgr closed this task as Invalid.Apr 2 2025, 5:27 PM

Just to double-check, here are some curl tests (could be turned into smoke tests with some effort, maybe worth it):
Top-level autologin:

$ curl -vL -o/dev/null 'https://en.wikipedia.org/wiki/Special:Userlogin' |& ack 'Issue another request|set-cookie:.*Session|x-centralauth-status:'
* Issue another request to this URL: 'https://en.wikipedia.org/wiki/Special:UserLogin'
* Issue another request to this URL: 'https://auth.wikimedia.org/loginwiki/wiki/Special:CentralAutoLogin/checkLoggedIn?useformat=desktop&type=redirect&returnUrlToken=609131dd3d7222bc6c8824157d612ce5&wikiid=enwiki&usesul3=1&useformat=desktop'
* Issue another request to this URL: 'https://login.wikimedia.org/wiki/Special:CentralAutoLogin/checkLoggedIn?useformat=desktop&wikiid=enwiki&usesul3=0&triedSul3Fallback=1&type=redirect&returnUrlToken=609131dd3d7222bc6c8824157d612ce5'
< x-centralauth-status: Not centrally logged in
* Issue another request to this URL: 'https://en.wikipedia.org/wiki/Special:UserLogin?centralAuthAutologinTried=1&centralAuthError=Not+centrally+logged+in'
< set-cookie: enwikiSession=7rg2b692k9pl6mhcfe54hosunf4os9e0; path=/; secure; HttpOnly; SameSite=None
* Issue another request to this URL: 'https://auth.wikimedia.org/enwiki/wiki/Special:UserLogin?useformat=desktop&usesul3=1&returnto=Main_Page&centralauthLoginToken=02324f65016270441e5332b63caf1b42'
< set-cookie: authSession=i27c208e6dhbbhpiioai6se0a5romp4u; path=/; secure; HttpOnly; SameSite=None

No-JS autologin (copied the URL from enwiki HTML source):

$ curl -vL -o/dev/null 'https://auth.wikimedia.org/loginwiki/wiki/Special:CentralAutoLogin/start?useformat=desktop&type=1x1&usesul3=1' |& ack 'Issue another request|set-cookie:.*Session|x-centralauth-status:'
< x-centralauth-status: Is central wiki, should be local

Apparently broken, but no session.

JS autologin (copied the URL from enwiki browser devtools):

$ curl -vL -o/dev/null 'https://en.wikipedia.org/wiki/Special:CentralAutoLogin/start?type=script&usesul3=0' |& ack 'Issue another request|set-cookie:.*Session|x-centralauth-status:'
* Issue another request to this URL: 'https://login.wikimedia.org/wiki/Special:CentralAutoLogin/checkLoggedIn?useformat=desktop&wikiid=enwiki&usesul3=0&type=script'
* Issue another request to this URL: 'https://auth.wikimedia.org/loginwiki/wiki/Special:CentralAutoLogin/checkLoggedIn?useformat=desktop&wikiid=enwiki&usesul3=1&triedSul3Fallback=1&type=script'

So this all seems to be working, at least in terms of not starting sessions.

Tgr added a comment.Apr 2 2025, 5:32 PM
In T390847#10705224, @Tgr wrote:

Apparently broken, but no session.

T390897: No-JS central autologin broken after SUL3

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits