Zebbler Encanti Experience - Psychic Projections - Data Mind
uuuuuuuuuuuuugh
Prophet5 joined the channel
zas joined the channel
reosarevok joined the channel
reosarevok
ocharles, do you have any idea of what causes the inability to stay logged in? :(
djce joined the channel
ocharles
reosarevok: no
or I would have fixed it :)
reosarevok
Meh, it's *very* annoying :(
ocharles
I know, it's a priority
reosarevok
Ok
ocharles
but I'm unable to even reproduce it myself
I'm assuming you're using beta?
I wonder if beta hasn't been updated and is setting the wrong cookie
I'm logged out on beta, but I'm still logged in on the main servers
reosarevok
No
I'm using prod
ocharles
Ok
reosarevok
On Chrome, in case it matters
I get logged out at least once a day (since every time I go check the subscription mail in the morning I'm logged out)
ocharles
Are you opening multiple tabs straight away?
reosarevok
Yeah, of course :)
(and usually some of them find me logged out, some do not - not necessarily in order, either)
ocharles
ok, try not doing that next time
It sounds race-conditiony
In fact, if all those tabs send the same cookie, then that's probably what logs you out
The first one would consume the remember me token, the next would try but fail because that token doesn't exist now, and would log you out
reosarevok
... er, ok
But that certainly would need fixing anyway
ocharles
That is something I can at least test
reosarevok
Ok
ocharles
sure, I'm just trying to work out what the problem is
djce joined the channel
djce joined the channel
Ok, I'm pretty convinced that multiple tabs is the problem.
If you have no session in progress, the browser will send your 'remember_me' token. The server consumes this token exclusively (it atomically gets/deletes it) and then opens a session for you, logging you in.
If you make another request without a session but with a 'remember_me' token, you will have a new session opened for you, but the 'remember_me' token will fail to authenticate you
Now you've removed your logged in session, and you will be logged out
Because the session is global (over musicbrainz.org), you're logged out in all tabs
I'm not sure how to fix this though. I could put a 'grace window' on token consumption, but then I have to write a little daemon to periodically clean these up. Maybe Redis can be set to do that
I'll give that a try and we'll see if things get better
warp
ocharles: redis can expire things for you
ocharles: why does the token need to be consumed?
ocharles
warp: they are one use tokens
djce joined the channel
warp
yes, why are they one use tokes? :)
ocharles
you don't want someone grabbing all your cookies because then they can always login as you
even if you've used that token up
yes, I'll try with redis and EXPIRE
and whenever a token is consumed, it will be set to expire in 5 minutes
warp
so in that case they're no longer one use tokens, but limited use tokes?
ocharles
yea
warp
ok, that sounds good.
(not having a session and then opening a bunch of musicbrainz tabs at once which should all log in with the remember me token is a valid thing to do :)
ocharles: if I do the above, will you still generate new remember me tokens for each of those tabs? or only once when the token is used while it is not yet expiring?
ocharles
at the moment, I will give you new tokens for all the tabs
maybe we should always expire these tokens after $some_large_duration
warp
ocharles: oh and.. can I stay logged in using a remember me tokens on different machines and different browsers?
ocharles
to prevent redis forever growing
warp: yes, each browser will have its own session store, and thus its own remember_me token
(and when you log in each will have its own session)
warp
ocharles: yes, redis stores everything in memory, so please do not store anything indefinitely :)
ocharles
:)
warp
(Though I'd suggest a year or so for the expire date of non-expiring remember me tokens)
ocharles
Yea, I was thinking a year
lame, you can't expire members in a set
And Redis.pm doesn't know what setex is, apparently
Ok, in review reosarevok
Should be able to go to beta soon :)
ocharles joined the channel
joy, enabling the nixos firewall stops ipv6 working :(
