To make it easy to interact with session cookies in non-MediaWiki infrastructure (where mapping between domain names and wiki IDs is not trivial), we use the same cookie name (sessionJwt) for all JWT cookies, regardless of the wiki. For CentralAuth wikis, we use the CentralAuth cookie settings (e.g. enwiki sets the cookie on .wikipedia.org). But that means JWTs for CentralAuth wikis and non-CentralAuth wikis (e.g. en.wikipedia.org and en-arbcom.wikipedia.org) conflict, causing session loss.
Description
Description
Details
Details
Related Changes in Gerrit:
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | JTweed-WMF | T398815 WE5.1.2 Verifiable MediaWiki sessions | |||
| Resolved | Tgr | T399631 Deploy JWT cookies to production | |||
| Resolved | Tgr | T406621 Session cookie JWTs of SUL and non-SUL wikis conflict |
Event Timeline
Comment Actions
I can think of three options:
- Prefix all non-CentralAuth JWT cookies by wiki name (ie. use the standard MediaWiki cookie prefix in CookieSessionProvider, and only override it in CentralAuthSessionProvider).
- Use sessionJwt for CentralAuth wikis, __Host-sessionJwt on non-CentralAuth wikis so the parent-domain cookie gets ignored.
- Never use the parent domain for JWT cookies.
Given the SRE preference for a single deterministic cookie name, the third option is clearly superior. (Two cookie names would be maybe not that bad but it might still cause issues on old browsers that don't understand the __Host- prefix.) We didn't really need the shared JWT cookies for anything, so I don't think there's any drawback. There will be slightly more cookies per eTLD+1 domain, but we haven't had any issues related to total cookie count for a long time.
The JWT cookies will still be shared on auth.wikimedia.org. That's fine since that's only used by SUL wikis so the cookie values don't conflict.
Comment Actions
Change #1194265 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/CentralAuth@master] jwt: Use core cookie settings
Comment Actions
Change #1194265 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@master] jwt: Use core cookie settings
Comment Actions
Change #1194603 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/CentralAuth@wmf/1.45.0-wmf.21] jwt: Use core cookie settings
Comment Actions
Change #1194604 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/CentralAuth@wmf/1.45.0-wmf.22] jwt: Use core cookie settings
Comment Actions
Change #1194603 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@wmf/1.45.0-wmf.21] jwt: Use core cookie settings
Comment Actions
Change #1194604 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@wmf/1.45.0-wmf.22] jwt: Use core cookie settings
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-10-08T13:56:11Z] <lucaswerkmeister-wmde@deploy2002> Started scap sync-world: Backport for [[gerrit:1194605|Temporarily undeploy JWT session cookies (T399631)]], [[gerrit:1194603|jwt: Use core cookie settings (T406621)]], [[gerrit:1194604|jwt: Use core cookie settings (T406621)]], [[gerrit:1194607|Force OATHManage to be on central domain (T401773)]], [[gerrit:1194150|Force OATHManage to be on central domain (T401773)]]
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-10-08T14:01:12Z] <lucaswerkmeister-wmde@deploy2002> d3r1ck01, lucaswerkmeister-wmde, reedy, tgr: Backport for [[gerrit:1194605|Temporarily undeploy JWT session cookies (T399631)]], [[gerrit:1194603|jwt: Use core cookie settings (T406621)]], [[gerrit:1194604|jwt: Use core cookie settings (T406621)]], [[gerrit:1194607|Force OATHManage to be on central domain (T401773)]], [[gerrit:1194150|Force OATHManage to be on central domain (T401773)
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-10-08T14:10:11Z] <lucaswerkmeister-wmde@deploy2002> Finished scap sync-world: Backport for [[gerrit:1194605|Temporarily undeploy JWT session cookies (T399631)]], [[gerrit:1194603|jwt: Use core cookie settings (T406621)]], [[gerrit:1194604|jwt: Use core cookie settings (T406621)]], [[gerrit:1194607|Force OATHManage to be on central domain (T401773)]], [[gerrit:1194150|Force OATHManage to be on central domain (T401773)]] (duration: 14m 0