Anomie added a comment.
It's hard to copy-paste from screenshots... Hopefully the OCR doesn't mangle things too badly. In T224712#6018928 <https://phabricator.wikimedia.org/T224712#6018928>, @Urbanecm wrote: > F31719968: image.png <https://phabricator.wikimedia.org/F31719968> In this response MediaWiki includes Set-Cookie headers resembling Set-Cookie: zhwikisourceSession=deleted; expires,Thu, 01-3an-1970 00:00:01 GMT; Max-Aged; path=/; secure; HttpOnly Set-Cookie: forceHTTPS=deleted; expires,Thu, 01-Ian-1970 00:00:01 GMT; Max-Aged; path4; domainG.wikisource.org; HttpOnly Set-Cookie: forceHTTPS=deleted; expires,Thu, 01-Ian-1970 00:00:01 GMT; Max-Aged; path4; HttpOnly Set-Cookie: centralauth_User=deleted; expires,Thu, 01-Ian-1970 00:00:01 GMT; Max-Age=0; path4; domainG.wikisource.org; secure; HttpOnly Set-Cookie: centralauth TokenGdeleted; expires,Thu, 01-Ian-1970 00:00:01 GMT; Max-Age=0; path4; domainG.wikisource.org; secure; HttpOnly Set-Cookie: centralauth_SessionGdeleted; expires,Thu, 01-3an-1970 00:00:01 GMT; Max-Age=0; path4; domainG.wikisource.org; secure; HttpOnly Set-Cookie: zhwikisourceSessionG4aqnnbi ; path=/; secure; HttpOnly > F31719972: image.png <https://phabricator.wikimedia.org/F31719972> However in this request you're still sending the centralauth_User, centralauth_Token, and centralauth_Session cookies that you were instructed to delete. That will cause MediaWiki to still attempt to use the specified CentralAuth session, which will fail because that session no longer exists. Hence the rejection of the token. > but either MW should've deleted _both_ occurances of the cookie, What "both"? > My current hypothesis is MediaWiki tries to refresh all session cookies if it spots one (in this case, the CentralAuth one) which is invalid. This could explain the cycle. That's a correct hypothesis. More specifically, it tries to load the CentralAuth session based on the supplied cookies, finds it invalid, and so produces Set-Cookie headers to tell the browser to delete the relevant cookies. Then (when applicable) it creates a new local session and sets the zhwikisourceSession cookie. TASK DETAIL https://phabricator.wikimedia.org/T224712 EMAIL PREFERENCES https://phabricator.wikimedia.org/settings/panel/emailpreferences/ To: Dvorapa, Anomie Cc: Reedy, Urbanecm, Jdforrester-WMF, Pchelolo, Anomie, Dvorapa, Framawiki, Aklapper, pywikibot-bugs-list, Dalba, Xqt, Oblanco79, Alter-paule, Beast1978, Un1tY, Zkhalido, Hook696, Daryl-TTMG, RomaAmorRoma, E.S.A-Sheild, WDoranWMF, Kent7301, Meekrab2012, joker88john, Viztor, DannyS712, CucyNoiD, NebulousIris, Wenyi, Gaboe420, Versusxo, Majesticalreaper22, Amorymeltzer, Giuliamocci, Adrian1985, Cpaulf30, Af420, Darkminds3113, Bsandipan, Lordiis, Adik2382, Th3d3v1ls, Ramalepe, Liugev6, Tbscho, MayS, Sethakill, WSH1906, Lewizho99, Mdupont, JJMC89, Maathavan, dg711, Altostratus, Avicennasis, mys_721tx, jayvdb, Masti, Alchimista, Rxy, Legoktm
_______________________________________________ pywikibot-bugs mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/pywikibot-bugs
