13

I rarely close Stack Overflow. Often just suddenly I'll be logged out when I go to a different page, or even up/down voting can kick me to the log in page.

Is anyone else getting this problem lately? If so, perhaps we can nail down what's causing it if we look for similarities between people experiencing this.

My circumstances:

  • Google Chrome Version 62.0.3202.62 (Official Build) beta (64-bit)
  • Google authentication
  • This happens while actively using the browser - restarting for updates doesn't seem to be the cause. I only lock the PC at night, so my session are very long.

Now that I've created a meta post, it isn't happening as often (typically) but in case it helps, I'm going to start logging whenever it happens. I'm seeing a pattern of it happening early arvo every workday.

  • 14:34 25/10/2017 AEST
  • 12:58 26/10/2017 AEST - I was browsing through a few questions, then got a access denied type message when attempting to add a comment. Refreshing showed that I had been logged out.
  • 13:03 27/10/2017 AEST - Browsing questions. After a few, I got one which had all of the "please sign in" banners everywhere.
  • 14:30 30/10/2017 AEST - Much the same. Browsing questions then suddenly...
  • 12:00 31/10/2017 AEST - Answered a question, then I couldn't upvote a related comment. These two actions were within a minute of each other.
  • 16:12 31/10/2017 AEST - Was trying to open the review menu - but it shows the loader, then closed. Did this a few times before refreshing and noticing I had been kicked again.
  • 14:06 1/11/2017 AEST - I clicked on a question, expecting to be logged out. In hindsite I should have checked that cookie first...
  • 16:19 1/11/2017 AEST - This one took me by surprise.
  • 11:11 2/11/2017 AEST - Well this one stuffs up my pattern...
  • 13:23 2/11/2017 AEST - Was going through the low quality posts queue
  • 14:36 2/11/2017 AEST - 3rd time today :O
  • 10:15 3/11/2017 AEST
  • 13:35 3/11/2017 AEST - Was posting an answer. Interestingly I got a captcha upon logging in which is interesting - I don't think I've ever seen one on this site before.
  • 10:27 8/11/2017 AEST - Weekend and annual leave since the 3rd. This one is interesting because it shows that I need to be active on the site for this to happen, as I didn't get logged off at all during the time I wasn't on the site.
  • 14:30 8/11/2017
  • 15:34 9/11/2017

I compared the cookies before and after authentication - and noticed that the acct cookie was reintroduced after authenticating. The new one is set to expire at 2018-04-30T01:01:35.094Z - so I find it hard to believe that the previous cookie expired...

This problem still occurs every workday - but as I don't think adding even more timestamps is going to help this problem, I'm going to stop. If anyone can think of anything to try, or a way to breakpoint when a cookie disappears, please let me know.

22
  • This has occurred to me when I have set my browser to open my tabs from the previous session and also set my browser to delete cookies and data on close. Do you have similar settings?
    – Suraj Rao
    Commented Oct 24, 2017 at 6:10
  • 2
    Beta browser? Might be something just busted there. We don't normally support dev/beta versions. Having said that, login/auth is high stakes, so I'm gonna keep an eye on this question and responses to see if any similarities show up beyond that.
    – Adam Lear StaffMod
    Commented Oct 24, 2017 at 7:01
  • 1
    same happened with me, win10 and the latest version of chrome (64 bit). Suddenly logged out of the entire SE network without pressing the logout button anywhere or deleting cookies. It's something weird going on with it Commented Oct 24, 2017 at 7:11
  • @AdamLear Chrome 62.0.3202.62 is the latest stable version on my machines. I don't have such issues, even though I'm having my SO tab open all day during work days. It could be an issue with Google auth, as I'm using the Stack Exchange OpenID to log in (using latest Windows 10 and Chrome, both 64-bit)
    – Filnor
    Commented Oct 24, 2017 at 7:30
  • 2
    Nope, I don't have any issues whatsoever. I use Firefox (52.4). Commented Oct 24, 2017 at 9:01
  • 17
    No issues at all, IE6
    – user4639281
    Commented Oct 24, 2017 at 14:36
  • 2
    No issues on Chrome Version 61.0.3163.100 (Official Build) (64-bit) or Version 62.0.3202.62 (Official Build) (64-bit) and I use SE credentials.
    – Script47
    Commented Oct 24, 2017 at 15:04
  • 41
    As long as it works on IE6, I think we are good.
    – yivi
    Commented Oct 24, 2017 at 15:07
  • 2
    What are the odds! Found this & this duplicate. :D Commented Oct 26, 2017 at 10:03
  • 2
    And this meta.stackoverflow.com/questions/305306/…
    – Dijkgraaf
    Commented Oct 26, 2017 at 10:05
  • 2
    @o_O I did find those before posting but those questions are from 2014... they may be related, but they're not duplicates. The cause has much more likely been introduced since then.
    – Shadow
    Commented Oct 26, 2017 at 22:11
  • 2
    Me too - Chrome Version 62.0.3202.62 (Official Build) (64-bit), macOS High Sierra (also happened with Sierra). I've had this problem for maybe a month.
    – 1615903
    Commented Oct 27, 2017 at 6:26
  • 1
    Thank you for tracking the timestamps. That's helpful. I finally had a chance to look into this a bit and... turns out, as far as our sessions table is concerned, none of those sessions have been invalidated on our end. I suppose it's possible that your browser just loses the auth cookie entirely... but I don't know off-hand why that'd happen. Are you perhaps behind a proxy?
    – Adam Lear StaffMod
    Commented Oct 31, 2017 at 0:12
  • 1
    @Shadow Cool, thanks. The cookie to keep an eye on is called "acct".
    – Adam Lear StaffMod
    Commented Oct 31, 2017 at 1:57
  • 1
    @Shadow Quite possible that it's different. It was only with certain sites though... I was able to log into other sites and stay logged into a few on tabs that I had open, while others completely crapped out. I figured it's worth throwing out there. :) Commented Nov 1, 2017 at 4:23

1 Answer 1

13

We fixed something today that might have been related; some code got added to our flair code - this thing:

Hotdog baby

(because everyone loves "Hotdog stand", right?)

The problem that got introduced is that the route accidentally (and indirectly) invoked the code-path that identifies who the current user is, and if appropriate: rotates their auth cookies (note: it doesn't matter whose flair you load - it can be anyone's - it doesn't have to be yours).

Now imagine that you're reading a blog with your (or someone else's) flair on it; your browser makes a request to load the image, and gets a Set-Cookie header in the image response, which it then drops on the floor because: heck to cookies from other domains, amiright?

So: there's a very good chance that this is what happened. Sorry about that, if so. This has been fixed today.

It is entirely possible that I ran into this earlier...

2
  • Hah. To think that lairy thing was the cause. I'll keep note over the next couple of days. Thanks :)
    – Shadow
    Commented Dec 6, 2017 at 22:10
  • 1
    I haven't been logged out all day- so I highly suspect this was indeed the bug I was encountering. :)
    – Shadow
    Commented Dec 7, 2017 at 1:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .