Page MenuHomePhabricator

JWT cookie causing anonymous session writes
Closed, ResolvedPublic

Description

The session writes dashboard shows a big increase in manual-forced writes for anonymous sessions:

Screenshot Capture - 2025-11-02 - 22-55-16.png (1,887×740 px, 133 KB)

That corresponds to the needsRefresh flag in SessionInfo, which is only used for updating JWT cookies. rMWf78fb6eb599a: session: Do not set JWT cookies for anonymous users was supposed to disable JWTs for anons and avoid that noise, but apparently something went wrong with that.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change #1208055 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/core@master] Do not refresh anonymous sessions due to missing JWTs

https://gerrit.wikimedia.org/r/1208055

Change #1208055 merged by jenkins-bot:

[mediawiki/core@master] Do not refresh anonymous sessions due to missing JWTs

https://gerrit.wikimedia.org/r/1208055

The manual-forced writes are gone as expected, but the total writes are still pretty high. Not sure what to think about it.

Screenshot Capture - 2025-12-12 - 17-23-19.png (1,887×635 px, 94 KB)

Actually not entirely expected - I think there should still be a small trickle of manual-forced writes from JWT cookie expiries for logged-in users, just much less than before? But we have zero now.

Do we still have concerns here or have we determined that this is expected?

No idea what was going on between 12-05 and 12-07 but we are now back to the old 20M/day-ish level of writes.

Screenshot Capture - 2026-01-23 - 23-01-02.png (1,898×594 px, 122 KB)