Authenticated data should not be in the anonymous store
Closed, ResolvedPublicPRODUCTION ERROR
Actions

Assigned To

Authored By

	DAlangi_WMF
	Sep 25 2025, 5:41 PM

Description

Error

mwversion: 1.45.0-wmf.20
reqId: 96c23bbe-6b5f-4de2-972c-b0fa63003e19
Find reqId in Logstash

normalized_message

Authenticated data should not be in the anonymous store

Frame	Location	Call
from	/srv/mediawiki/php-1.45.0-wmf.20/includes/session/MultiBackendSessionStore.php(216)
#0	/srv/mediawiki/php-1.45.0-wmf.20/includes/session/SessionBackend.php(183)	MediaWiki\Session\MultiBackendSessionStore->get(MediaWiki\Session\SessionInfo)
#1	/srv/mediawiki/php-1.45.0-wmf.20/includes/session/SessionManager.php(980)	MediaWiki\Session\SessionBackend->__construct(MediaWiki\Session\SessionId, MediaWiki\Session\SessionInfo, MediaWiki\Session\MultiBackendSessionStore, Monolog\Logger, MediaWiki\HookContainer\HookContainer, int)
#2	/srv/mediawiki/php-1.45.0-wmf.20/includes/session/SessionManager.php(155)	MediaWiki\Session\SessionManager->getSessionFromInfo(MediaWiki\Session\SessionInfo, MediaWiki\Request\WebRequest)
#3	/srv/mediawiki/php-1.45.0-wmf.20/includes/Request/WebRequest.php(874)	MediaWiki\Session\SessionManager->getSessionForRequest(MediaWiki\Request\WebRequest)
#4	/srv/mediawiki/php-1.45.0-wmf.20/includes/Setup.php(516)	MediaWiki\Request\WebRequest->getSession()
#5	/srv/mediawiki/php-1.45.0-wmf.20/includes/WebStart.php(86)	require_once(string)
#6	/srv/mediawiki/php-1.45.0-wmf.20/api.php(37)	require(string)
#7	/srv/mediawiki/w/api.php(3)	require(string)
#8	{main}

Impact

[warnings] 2 occurrences in the last 24 hours

Notes

Details

Request URL: https://test.wikipedia.org/w/api.php?format=*&formatversion=*&errorformat=*&centralauthtoken=*&action=query&prop=*&intestactions=*&titles=*&intestactionsdetail=*

Related Changes in Gerrit:

Subject	Repo	Branch	Lines +/-
session: Avoid logging in session store if UserInfo is available	mediawiki/core	master	+32 -23
session: Improve logging for MultiBackendSessionStore	mediawiki/core	wmf/1.45.0-wmf.22	+17 -18
session: Improve logging for MultiBackendSessionStore	mediawiki/core	wmf/1.45.0-wmf.21	+17 -18
session: Improve logging for MultiBackendSessionStore	mediawiki/core	master	+17 -18
session: Check that `$anonUserId` is not null (like other cases)	mediawiki/core	master	+1 -1
session: Log cache write flags in `SessionStore::set()`	mediawiki/core	wmf/1.45.0-wmf.22	+2 -0
session: Log cache write flags in `SessionStore::set()`	mediawiki/core	wmf/1.45.0-wmf.21	+2 -0
session: Log cache write flags in `SessionStore::set()`	mediawiki/core	master	+2 -0

Customize query in gerrit

Related Objects
Search...

Status	Subtype	Assigned	Task
Resolved		JTweed-WMF	T398814 WE5.1.1 Session storage protection
Resolved		JTweed-WMF	T400372 Separate storage backend for anonymous sessions
Resolved		DAlangi_WMF	T402808 Deploy separate anonymous session backend to Wikimedia production, in log-only mode
Resolved	PRODUCTION ERROR	DAlangi_WMF	T405634 Authenticated data should not be in the anonymous store

Event Timeline

DAlangi_WMF created this task.Sep 25 2025, 5:41 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 25 2025, 5:41 PM

A_smart_kitten added a project: MediaWiki-Core-AuthManager.Sep 25 2025, 7:01 PM

JTweed-WMF moved this task from Inbox, needs triage to Next (DO NOT USE) on the MediaWiki-Platform-Team board.Sep 29 2025, 2:54 PM

DAlangi_WMF claimed this task.Oct 6 2025, 5:08 PM

DAlangi_WMF moved this task from Next (DO NOT USE) to In progress (DO NOT USE) on the MediaWiki-Platform-Team board.

DAlangi_WMF closed this task as a duplicate of T405633: Session data is authenticated, should not be an anonymous user.Oct 7 2025, 9:52 AM

DAlangi_WMF mentioned this in T405633: Session data is authenticated, should not be an anonymous user.Oct 7 2025, 10:14 AM

Actually, this is not a duplicate; it is about the get() path, and the other one is the set() code path. Reopening.

The root cause might be the same for both actually.

Change #1194188 had a related patch set uploaded (by D3r1ck01; author: Derick Alangi):

[mediawiki/core@master] session: Write cache write flags in `SessionStore::set()`

https://gerrit.wikimedia.org/r/1194188

gerritbot added a project: Patch-For-Review.Oct 7 2025, 12:50 PM

Tgr added a parent task: T402808: Deploy separate anonymous session backend to Wikimedia production, in log-only mode.Oct 7 2025, 7:45 PM

Change #1194281 had a related patch set uploaded (by Gergő Tisza; author: Derick Alangi):

[mediawiki/core@wmf/1.45.0-wmf.21] session: Log cache write flags in `SessionStore::set()`

https://gerrit.wikimedia.org/r/1194281

Change #1194282 had a related patch set uploaded (by Gergő Tisza; author: Derick Alangi):

[mediawiki/core@wmf/1.45.0-wmf.22] session: Log cache write flags in `SessionStore::set()`

https://gerrit.wikimedia.org/r/1194282

Change #1194188 merged by jenkins-bot:

[mediawiki/core@master] session: Log cache write flags in `SessionStore::set()`

https://gerrit.wikimedia.org/r/1194188

Change #1194281 merged by jenkins-bot:

[mediawiki/core@wmf/1.45.0-wmf.21] session: Log cache write flags in `SessionStore::set()`

https://gerrit.wikimedia.org/r/1194281

Change #1194282 merged by jenkins-bot:

[mediawiki/core@wmf/1.45.0-wmf.22] session: Log cache write flags in `SessionStore::set()`

https://gerrit.wikimedia.org/r/1194282

Mentioned in SAL (#wikimedia-operations) [2025-10-07T21:30:44Z] <tgr@deploy2002> Started scap sync-world: Backport for [[gerrit:1194261|session: Log actual class name in preventSessionsForUser exception (T406566)]], [[gerrit:1194262|session: Log actual class name in preventSessionsForUser exception (T406566)]], [[gerrit:1194281|session: Log cache write flags in SessionStore::set() (T405633 T405634)]], [[gerrit:1194282|session: Log cache write flags in SessionStore::set() (T4056

Stashbot mentioned this in T4056: Link to media file missing from description page in 1.5.Oct 7 2025, 9:30 PM

Stashbot mentioned this in T406566: BadMethodCallException: MediaWiki\Session\SessionProvider::preventSessionsForUser must be implemented when canChangeUser() is false.

Maintenance_bot removed a project: Patch-For-Review.Oct 7 2025, 9:31 PM

Mentioned in SAL (#wikimedia-operations) [2025-10-07T21:34:47Z] <tgr@deploy2002> tgr: Backport for [[gerrit:1194261|session: Log actual class name in preventSessionsForUser exception (T406566)]], [[gerrit:1194262|session: Log actual class name in preventSessionsForUser exception (T406566)]], [[gerrit:1194281|session: Log cache write flags in SessionStore::set() (T405633 T405634)]], [[gerrit:1194282|session: Log cache write flags in SessionStore::set() (T405633 T405634)]] synced

Mentioned in SAL (#wikimedia-operations) [2025-10-07T21:40:21Z] <tgr@deploy2002> Finished scap sync-world: Backport for [[gerrit:1194261|session: Log actual class name in preventSessionsForUser exception (T406566)]], [[gerrit:1194262|session: Log actual class name in preventSessionsForUser exception (T406566)]], [[gerrit:1194281|session: Log cache write flags in SessionStore::set() (T405633 T405634)]], [[gerrit:1194282|session: Log cache write flags in SessionStore::set() (T405

Stashbot mentioned this in T405: USER GROUP: Understanding and Build Up an Ecosystem - Compile List of Third Party Contacts.Oct 7 2025, 9:40 PM

ReleaseTaggerBot added a project: MW-1.45-notes (1.45.0-wmf.22; 2025-10-07).Oct 7 2025, 10:00 PM

Change #1194582 had a related patch set uploaded (by D3r1ck01; author: Derick Alangi):

[mediawiki/core@master] session: Check that `$anonUserId` is not null (like other cases)

https://gerrit.wikimedia.org/r/1194582

gerritbot added a project: Patch-For-Review.Oct 8 2025, 10:27 AM

Change #1194663 had a related patch set uploaded (by D3r1ck01; author: Derick Alangi):

[mediawiki/core@master] session: Improve logging for MultiBackendSessionStore

https://gerrit.wikimedia.org/r/1194663

Change #1194582 abandoned by D3r1ck01:

[mediawiki/core@master] session: Check that `$anonUserId` is not null (like other cases)

Reason:

Per If9c4a13f7e49349cf344e32a4f6e2714e9e44e3a, we're not using userID anymore.

https://gerrit.wikimedia.org/r/1194582

Change #1194663 merged by jenkins-bot:

[mediawiki/core@master] session: Improve logging for MultiBackendSessionStore

https://gerrit.wikimedia.org/r/1194663

Maintenance_bot removed a project: Patch-For-Review.Oct 9 2025, 2:31 PM

Change #1194963 had a related patch set uploaded (by D3r1ck01; author: Derick Alangi):

[mediawiki/core@wmf/1.45.0-wmf.21] session: Improve logging for MultiBackendSessionStore

https://gerrit.wikimedia.org/r/1194963

Change #1194964 had a related patch set uploaded (by D3r1ck01; author: Derick Alangi):

[mediawiki/core@wmf/1.45.0-wmf.22] session: Improve logging for MultiBackendSessionStore

https://gerrit.wikimedia.org/r/1194964

ReleaseTaggerBot edited projects, added MW-1.45-notes (1.45.0-wmf.23; 2025-10-14); removed MW-1.45-notes (1.45.0-wmf.22; 2025-10-07).Oct 9 2025, 3:00 PM

Change #1194963 merged by jenkins-bot:

[mediawiki/core@wmf/1.45.0-wmf.21] session: Improve logging for MultiBackendSessionStore

https://gerrit.wikimedia.org/r/1194963

Change #1194964 merged by jenkins-bot:

[mediawiki/core@wmf/1.45.0-wmf.22] session: Improve logging for MultiBackendSessionStore

https://gerrit.wikimedia.org/r/1194964

Mentioned in SAL (#wikimedia-operations) [2025-10-09T16:10:27Z] <tgr@deploy2002> Started scap sync-world: Backport for [[gerrit:1194963|session: Improve logging for MultiBackendSessionStore (T402808 T405633 T405634)]], [[gerrit:1194964|session: Improve logging for MultiBackendSessionStore (T402808 T405633 T405634)]]

Stashbot mentioned this in T402808: Deploy separate anonymous session backend to Wikimedia production, in log-only mode.Oct 9 2025, 4:10 PM

Mentioned in SAL (#wikimedia-operations) [2025-10-09T16:14:09Z] <tgr@deploy2002> tgr, d3r1ck01: Backport for [[gerrit:1194963|session: Improve logging for MultiBackendSessionStore (T402808 T405633 T405634)]], [[gerrit:1194964|session: Improve logging for MultiBackendSessionStore (T402808 T405633 T405634)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2025-10-09T16:30:34Z] <tgr@deploy2002> Finished scap sync-world: Backport for [[gerrit:1194963|session: Improve logging for MultiBackendSessionStore (T402808 T405633 T405634)]], [[gerrit:1194964|session: Improve logging for MultiBackendSessionStore (T402808 T405633 T405634)]] (duration: 20m 07s)

Maintenance_bot removed a project: Patch-For-Review.Oct 9 2025, 4:30 PM

ReleaseTaggerBot edited projects, added MW-1.45-notes (1.45.0-wmf.22; 2025-10-07); removed MW-1.45-notes (1.45.0-wmf.23; 2025-10-14).Oct 9 2025, 5:00 PM

Change #1195029 had a related patch set uploaded (by D3r1ck01; author: Derick Alangi):

[mediawiki/core@master] session: Avoid logging in session store if UserInfo is available

https://gerrit.wikimedia.org/r/1195029

gerritbot added a project: Patch-For-Review.Oct 9 2025, 7:05 PM

Logs look clear now. The other case is still open until they resolved.

Change #1195029 abandoned by D3r1ck01: