2021-11-11 Updates
Thanks for @MilkyDefer's comment in T244635#7498372
**Steps to reproduce**:
1. Make sure your account doesn't have a local account in en.wikipedia.org (Check it in https://meta.wikimedia.org/wiki/Special:CentralAuth)
2. Make sure your account have ipblock-exempt permission in zh.wikipedia.org
3. Visit wikis through a globally blocked IP (Make sure you cannot create accounts in https://en.wikipedia.org/wiki/Special:CreateAccount)
4. Visit https://zh.wikipedia.org/w/index.php?title=Wikipedia:%E6%B2%99%E7%9B%92&action=edit&safemode=1
5. You should able to edit this page because you have ipblock-exempt permission in zh.wikipedia.org.
6. Run following JavaScript in your browser console (You can load any js in en.wikipedia.org)
```lang=javascript
mw.loader.load('//en.wikipedia.org/w/index.php?title=User:Xiplus/emptyscript.js&action=raw&ctype=text/javascript&t=' + Date.now())
```
7. Check the request information in browser dev tools. Check the Response Headers. You can see
```
set-cookie: ss0-enwikiSession=SECRET1; path=/; secure; HttpOnly
set-cookie: enwikiSession=SECRET1; path=/; secure; HttpOnly; SameSite=None
set-cookie: centralauth_ss0-User=YOURUSERNAME; expires=Fri, 11-Nov-2022 12:13:44 GMT; Max-Age=31536000; path=/; domain=.wikipedia.org; secure; HttpOnly
set-cookie: centralauth_User=YOURUSERNAME; expires=Fri, 11-Nov-2022 12:13:44 GMT; Max-Age=31536000; path=/; domain=.wikipedia.org; secure; HttpOnly; SameSite=None
set-cookie: centralauth_ss0-Token=SECRET2; expires=Fri, 11-Nov-2022 12:13:44 GMT; Max-Age=31536000; path=/; domain=.wikipedia.org; secure; HttpOnly
set-cookie: centralauth_Token=SECRET2; expires=Fri, 11-Nov-2022 12:13:44 GMT; Max-Age=31536000; path=/; domain=.wikipedia.org; secure; HttpOnly; SameSite=None
set-cookie: ss0-centralauth_Session=SECRET3; path=/; domain=.wikipedia.org; secure; HttpOnly
set-cookie: centralauth_Session=SECRET3; path=/; domain=.wikipedia.org; secure; HttpOnly; SameSite=None
```
8. Run the script in step 6 again
9. Check the Response Headers again. You can see
```
set-cookie: ss0-enwikiSession=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure; HttpOnly
set-cookie: enwikiSession=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure; HttpOnly; SameSite=None
set-cookie: centralauth_ss0-User=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.wikipedia.org; secure; HttpOnly
set-cookie: centralauth_User=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.wikipedia.org; secure; HttpOnly; SameSite=None
set-cookie: centralauth_ss0-Token=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.wikipedia.org; secure; HttpOnly
set-cookie: centralauth_Token=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.wikipedia.org; secure; HttpOnly; SameSite=None
set-cookie: ss0-centralauth_Session=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.wikipedia.org; secure; HttpOnly
set-cookie: centralauth_Session=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.wikipedia.org; secure; HttpOnly; SameSite=None
```
10. Your cookies are deleted. Then reload the page.
11. You are logged out. You can't edit the page because your IP is blocked.
12. Wait a second. Then you can see "Central login" notification (You are centrally logged in as XXX. Reload the page to apply your user settings.).
13. Reload the page. You can edit the page now because you are logged in.
----
**Steps to reproduce**:
1. Visit zh.wikipedia.org through a globally blocked IP (usually an open proxy)
2. Login an account with no autoconfirmed flag
3. Ask a local admin to grant IPBE to the account
4. Click the "edit" button on a page
**Expected**: Edit box and tools appears normally.
**Actual**: A hint appears on the upper right corner, saying:
```
Central login
You are centrally logged in as <username>. Reload the page to apply your user settings.
```
Meanwhile, username on the upper right corner is replaced by `Not logged in`. Since we are using a globally blocked IP, the block interface also appears. ([[ https://i.loli.net/2020/02/07/zVunA8x3HevOgIT.png | Screeshot on zhwiki]])
**Steps to reproduce** (continue):
5. Refresh the page (follow directions given)
6. Preview the changes (forced to do this because the account is not autoconfirmed)
7. Publish the changes
**Expected**: Return to read mode and see the changed things.
**Actual**: What happened before occurred again. We lose login session once we click the "Save" button and return to edit mode after refreshing the page. The changes we made will never be published (because the IP is blocked, it is impossible to save them without login).
----
Before reporting this problem here, I tried granting confirmed flag to affected users. They successfully saved their changes after getting confirmed permission. However, some of our abusefilters and other anti-vandalism stuffs rely on confirmed flags so that we are not expected to grant it simply for avoiding this technical problem.
Some affected users also reported successful edits after changing to those IPs which are not globally blocked. Therefore, I guess it is using globally blocked IP and having no confirmed flag that lead to login session losing.
I yet don't know whether there's a chance to meet this issue or it always happen (if you follow the step mentioned above). At least users who were granted confirmed flag saw no problem in saving changes.
----
Sysops and experienced users on zhwiki received report of this issue from both mobile and desktop version, as well as various browsers and operating systems (If my memory is correct). We also asked the affected users to check their cookie settings and find no problem there. Though I have only seen reports from zhwiki, I believe that this is a general MediaWiki problem.