Special:UserLogin breaks, when no "remoteUser" is set
Open, Needs TriagePublicBUG REPORT
Actions

Assigned To

None

Authored By

	Osnard
	Aug 22 2025, 1:34 PM

Description

Steps to replicate the issue (include links if applicable):

Install MediaWiki 1.34
Install Extension:Auth_remoteuser from branch REL1_43
Add to LocalSettings.php

$wgShowExceptionDetails = true;

wfLoadExtension( 'Auth_remoteuser' );
$wgAuthRemoteuserAllowUserSwitch = true;
$wgAuthRemoteuserUserName = static function() {
        return '';
};

Navigate to "Special:Userlogin"

What happens?:
Error shown:

MediaWiki internal error.

Original exception: [aa276c1906ae74ee6e3302bc] /w/index.php?title=Special:UserLogin&returnto=Main+Page&returntoquery=sfr%3Dw TypeError: Cannot assign null to property MediaWiki\Extension\Auth_remoteuser\UserNameSessionProvider::$remoteToken of type string
Backtrace:
from extensions/Auth_remoteuser/src/UserNameSessionProvider.php(793)
#0 includes/session/SessionBackend.php(757): MediaWiki\Extension\Auth_remoteuser\UserNameSessionProvider->persistSession()
#1 includes/session/SessionBackend.php(671): MediaWiki\Session\SessionBackend->save()
#2 includes/session/SessionBackend.php(347): MediaWiki\Session\SessionBackend->autosave()
#3 includes/session/Session.php(133): MediaWiki\Session\SessionBackend->persist()
#4 includes/specialpage/LoginSignupSpecialPage.php(303): MediaWiki\Session\Session->persist()
#5 includes/specialpage/SpecialPage.php(728): MediaWiki\SpecialPage\LoginSignupSpecialPage->execute()
#6 includes/specialpage/SpecialPageFactory.php(1717): MediaWiki\SpecialPage\SpecialPage->run()
#7 includes/actions/ActionEntryPoint.php(504): MediaWiki\SpecialPage\SpecialPageFactory->executePath()
#8 includes/actions/ActionEntryPoint.php(146): MediaWiki\Actions\ActionEntryPoint->performRequest()
#9 includes/MediaWikiEntryPoint.php(200): MediaWiki\Actions\ActionEntryPoint->execute()
#10 index.php(58): MediaWiki\MediaWikiEntryPoint->run()
#11 {main}

Exception caught inside exception handler: [aa276c1906ae74ee6e3302bc] /w/index.php?title=Special:UserLogin&returnto=Main+Page&returntoquery=sfr%3Dw TypeError: Cannot assign null to property MediaWiki\Extension\Auth_remoteuser\UserNameSessionProvider::$remoteToken of type string
Backtrace:
from extensions/Auth_remoteuser/src/UserNameSessionProvider.php(793)
#0 includes/session/SessionBackend.php(757): MediaWiki\Extension\Auth_remoteuser\UserNameSessionProvider->persistSession()
#1 includes/session/SessionBackend.php(660): MediaWiki\Session\SessionBackend->save()
#2 [internal function]: MediaWiki\Session\SessionBackend->{closure:MediaWiki\Session\SessionBackend::delaySave():657}()
#3 vendor/wikimedia/scoped-callback/src/ScopedCallback.php(102): call_user_func_array()
#4 vendor/wikimedia/scoped-callback/src/ScopedCallback.php(58): Wikimedia\ScopedCallback->__destruct()
#5 includes/session/SessionManager.php(954): Wikimedia\ScopedCallback::consume()
#6 includes/session/SessionManager.php(271): MediaWiki\Session\SessionManager->getSessionFromInfo()
#7 includes/Request/WebRequest.php(861): MediaWiki\Session\SessionManager->getSessionById()
#8 includes/skins/Skin.php(1767): MediaWiki\Request\WebRequest->getSession()
#9 includes/skins/Skin.php(1776): Skin->hideNewTalkMessagesForCurrentSession()
#10 includes/skins/SkinMustache.php(129): Skin->getNewtalks()
#11 skins/Vector/includes/SkinVector22.php(328): SkinMustache->getTemplateData()
#12 includes/skins/SkinMustache.php(93): MediaWiki\Skins\Vector\SkinVector22->getTemplateData()
#13 includes/skins/SkinTemplate.php(180): SkinMustache->generateHTML()
#14 includes/skins/Skin.php(683): SkinTemplate->outputPage()
#15 includes/Output/OutputPage.php(3193): Skin->outputPageFinal()
#16 includes/exception/MWExceptionRenderer.php(190): MediaWiki\Output\OutputPage->output()
#17 includes/exception/MWExceptionRenderer.php(109): MWExceptionRenderer::reportHTML()
#18 includes/exception/MWExceptionHandler.php(135): MWExceptionRenderer::output()
#19 includes/exception/MWExceptionHandler.php(239): MWExceptionHandler::report()
#20 includes/MediaWikiEntryPoint.php(222): MWExceptionHandler::handleException()
#21 includes/actions/ActionEntryPoint.php(82): MediaWiki\MediaWikiEntryPoint->handleTopLevelError()
#22 includes/MediaWikiEntryPoint.php(206): MediaWiki\Actions\ActionEntryPoint->handleTopLevelError()
#23 index.php(58): MediaWiki\MediaWikiEntryPoint->run()
#24 {main}

What should have happened instead?:
Login form should be shown

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):

MediaWiki 1.43
Extension:Auth_remoteuser at c985d520c7aea38092ee7208be31f07a7251210d

Other information (browser name/version, screenshots, etc.):
Looks like the Auth_remoteuser SessionProvider is used instead of the CookieSessionProvider of MediaWiki. This is because no <wikiid>session cookie is set.

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	Fix "user switch"	mediawiki/extensions/Auth_remoteuser	REL1_43	+10 -0

Customize query in gerrit

Event Timeline

Osnard created this task.Aug 22 2025, 1:34 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 22 2025, 1:34 PM

Change #1181142 had a related patch set uploaded (by Robert Vogel; author: Robert Vogel):

[mediawiki/extensions/Auth_remoteuser@REL1_43] Fix "user switch"

https://gerrit.wikimedia.org/r/1181142

gerritbot added a project: Patch-For-Review.Aug 22 2025, 2:37 PM

Potential fix at https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Auth_remoteuser/+/1181142

HINT: One could also override SessionProvider::persistsSessionId and make it return false, but then the "user switch" functionality of this extension would not work anymore. The "remote user" would always take precedence over the one set by CookieSessionProvider.

Thanks @Osnard! If someone is logging in using Auth_remoteuser, does the fix still allow them to successfully log in? Or does it essentially turn off the Auth_remoteuser SessionProvider?

Sorry for keeping you waiting. I'll check next week and provide an answer

If someone is logging in using Auth_remoteuser, does the fix still allow them to successfully log in?

Yes, this change does not break any general functionality. When one of the build in mechanisms (e.g. $wgAuthRemoteuserUserName or the UserNameSessionProviderFilterUserName hook) return a valid user name, the session will be properly established.

Or does it essentially turn off the Auth_remoteuser SessionProvider?

No, UserNameSessionProvider::newSessionInfo is only called in very rare cases: SessionManager::getSessionById / SessionManager::getEmptySession when there is not already a session, e.g. when a user has not been authenticated by Extension:Auth_remoteuser and enters Special:Userlogin

I have tested the change on a MediaWiki 1.43 and can confirm the following cases work:

$wgAuthRemoteuserUserName returns a valid user name -> User is being authenticated (session gets created by Extension:Auth_remoteuser)
$wgAuthRemoteuserUserName returns a valid user name, user is being authenticated and "switches user context" by using form based authentication on Special:UserLogin -> Session properly switches to the one created by Special:Userlogin. When logging out via Special:UserLogout, session provided by Extension:Auth_remoteuser comes back.
$wgAuthRemoteuserUserName does not return a valid user name, user is not authenticated Extension:Auth_remoteuser -> Logging in via Special:Userlogin works.

I hope that covers your questions. Please let me know if you need more information.

Special:UserLogin breaks, when no "remoteUser" is setOpen, Needs TriagePublicBUG REPORTActions

Description

Details

Event Timeline

Special:UserLogin breaks, when no "remoteUser" is set
Open, Needs TriagePublicBUG REPORT
Actions