There's a big spike in login attempts with WikipediaApps/Android UA around Dec 12 and elevated levels since then, I wonder if it's related. (Of course, could just be a fake UA.)

We looked into a few examples and AuthManager was terminating the session with Metadata merge failed (usually an invalid/outdated cookie). It's happening on the next request after a successful login; AFAIK there is no easy way to connect those in Logstash and check whether this is a common pattern with all extra logins.

JWT session cookie handling is the one thing that changed somewhat recently (T399631: Deploy JWT cookies to production); it was enabled in October (beyond the Logstash retention cutoff, unfortunately). I don't recall any significant authentication changes in December.

Also reported in T413747: User reports of ~ 500 failed logins (December).

We had a discussion about automatic login in apps in {T398886} (May) but back then the number of logins per user didn't seem large. Maybe we had this issue back then and just didn't notice, but more likely this is a relatively recent change.

In T415675#11560284, @Tgr wrote:

Also reported in T413747: User reports of ~ 500 failed logins (December).

Nevermind, those are failed logins, so not really the same issue.

cooltey closed https://github.com/wikimedia/apps-android-wikipedia/pull/6245

For QA: for now, it's sufficient to just verify that logging in normally is working as expected.
This task is just to reduce the number of background re-logins, of a kind that we haven't been able to reproduce yet.

Working for me on 50566-r-2026-02-02. Tested on OnePlus 8 on Android 13, and Pixel 6 on Android 16. Tested with multiple logins and logouts.