29

I'm using Firefox (currently v112 v114 v122 v125 v127 v130 V132) on macOS (currently 12.6 (Monterey) 13.3 13.6 (Ventura)). This began happening a couple of months back. Every morning I'd wake up my Mac, go to stackoverflow.com, and find that I'm logged out. I'd log back in and things would be fine. After a few hours, I'd go to stackoverflow.com again and find that I'm logged out again.

Aside from using SO interactively, I also use the Feedbro extension to subscribe to a couple of question feeds among other things:

These feeds refresh every two hours.

I found that when I'm logged into SO I have a cookie on ".stackoverflow.com" named "acct", along with some other cookies. The "acct" cookie normally expires about six months in the future. When I find myself not logged in, I would check the cookie list and find this "acct" cookie is missing.

Long story short, using Proxyman I found that when Feedbro refreshes its SO question feeds, the responses sometimes include a set-cookie for the "acct" cookie with an expiration date in the past. This apparently causes Firefox to drop the cookie.

For what it's worth, this only happens on stackoverflow.com. I also subscribe to one feed each on superuser and unix&linux, and I'm not being logged out there.

Here's an example of a request and response captured by Proxyman ("yaddas" added by me):

GET /feeds/tag?tagnames=scp+or+ssh+or+sftp+or+jsch+or+openssh&sort=featured HTTP/1.1
Host: stackoverflow.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
If-Modified-Since: Tue, 18 Apr 2023 12:42:43 GMT
Connection: keep-alive
Cookie: prov=e40d4f1a-yadda-yadda; acct=t=mBkrzwyaddayadda; OptanonAlertBoxClosed=2023-04-13T13:31:25.450Z; OptanonConsent=datestamp=2023-04-13+13%3a30%3a01Z&groups=C0001%3a1%2cC0002%3a0%2cC0003%3a0%2cC0004%3a0%2cC0005%3a0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

Response:

HTTP/1.1 200 OK
Connection: keep-alive
cache-control: public, max-age=300
content-type: application/atom+xml
expires: Tue, 18 Apr 2023 13:10:33 GMT
last-modified: Tue, 18 Apr 2023 13:05:33 GMT
strict-transport-security: max-age=15552000
x-frame-options: SAMEORIGIN
x-request-guid: c98dbdeb-023a-4fa2-8e8f-f52e35fe8d51
set-cookie: acct=t&s; expires=Mon, 17 Apr 2023 13:05:33 GMT; domain=.stackoverflow.com; path=/; secure; samesite=none; httponly
set-cookie: prov_tgt=; expires=Sun, 16 Apr 2023 13:05:33 GMT; domain=.stackoverflow.com; path=/; secure; samesite=none; httponly
feature-policy: microphone 'none'; speaker 'none'
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com
Accept-Ranges: bytes
Date: Tue, 18 Apr 2023 13:05:33 GMT
Via: 1.1 varnish
X-Served-By: cache-chi-kigq8000161-CHI
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1681823133.459514,VS0,VE33
Vary: Fastly-SSL
X-DNS-Prefetch-Control: off
transfer-encoding: chunked

<feed yadda yadda

After this particular request I also found two warning messages in the Firefox console:

Cookie “prov_tgt” has been rejected because it is already expired. tag
Cookie “acct” has been rejected because it is already expired. tag

"tag" here is a link to the RSS feed.

Edit: After Adam Lear's comment I ran another test. As background, I've had this issue with my main/only firefox profile for a while. Last week I created a second firefox profile for testing. In that profile I opened a SO window, logged in, and left it alone with the inspector displaying cookies. The window sat there for several days without any changes to the cookies. Yesterday I added the Feedbro extension to the test profile, configured the two SO question feed URLs, slightly altered ("scp" before "ssh"), and installed Proxyman to capture requests. Eventually feedbro refreshed those feeds and the "acct" cookie disappeared. That's the request/response reported above.

After Adam's comment, I Deleted the "acct" cookie and signed in again, getting this "acct" cookie at 16:13 local time:

set-cookie: acct=t=AvAyyYd8QGe9gxmNZ%2b532Cw%2bRXXaKufR&s=gZdfsRt3%2fCTcqOZlWFD6mDi0ag97zYPV; expires=Wed, 18 Oct 2023 20:13:13 GMT; domain=.stackoverflow.com; path=/; secure; samesite=none; httponly

After that I left the computer alone overnight. FeedBro (both in the test profile and my regular profile) were making queries every two hours to update the feeds. This morning I found the "acct" cookie missing from the test profile again.

Here's an example request/response at 18:14 local time where nothing funny happened to the keys:

GET /feeds/tag?tagnames=scp+or+ssh+or+sftp+or+jsch+or+openssh&sort=featured HTTP/1.1
Host: stackoverflow.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
If-Modified-Since: Tue, 18 Apr 2023 20:13:56 GMT
Connection: keep-alive
Cookie: prov=e40d4f1a-2756-bb71-0420-1c459f63cd61; OptanonAlertBoxClosed=2023-04-13T13:31:25.450Z; OptanonConsent=datestamp=2023-04-13+13%3a30%3a01Z&groups=C0001%3a1%2cC0002%3a0%2cC0003%3a0%2cC0004%3a0%2cC0005%3a0; acct=t=AvAyyYd8QGe9gxmNZ%2b532Cw%2bRXXaKufR&s=gZdfsRt3%2fCTcqOZlWFD6mDi0ag97zYPV
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Connection: keep-alive
cache-control: public, max-age=300
content-type: application/atom+xml
expires: Tue, 18 Apr 2023 22:19:25 GMT
last-modified: Tue, 18 Apr 2023 22:14:25 GMT
strict-transport-security: max-age=15552000
x-frame-options: SAMEORIGIN
x-request-guid: 8e0c5b69-68e6-4b31-9a8a-1d65af991774
feature-policy: microphone 'none'; speaker 'none'
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com
Accept-Ranges: bytes
Date: Tue, 18 Apr 2023 22:14:25 GMT
Via: 1.1 varnish
X-Served-By: cache-chi-kigq8000113-CHI
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1681856066.631551,VS0,VE31
Vary: Fastly-SSL
X-DNS-Prefetch-Control: off
transfer-encoding: chunked

<feed redacted...

The "acct" key in the request looks like the same "t=AvAyy..." key from earlier.

Here's the next two queries at 20:14. It looks like Feedbro sends its queries one at a time. First it queried for the "newest" feed:

GET /feeds/tag?tagnames=scp+or+ssh+or+sftp+or+jsch+or+openssh&sort=newest HTTP/1.1
Host: stackoverflow.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
If-Modified-Since: Tue, 18 Apr 2023 22:14:25 GMT
Connection: keep-alive
Cookie: prov=e40d4f1a-2756-bb71-0420-1c459f63cd61; OptanonAlertBoxClosed=2023-04-13T13:31:25.450Z; OptanonConsent=datestamp=2023-04-13+13%3a30%3a01Z&groups=C0001%3a1%2cC0002%3a0%2cC0003%3a0%2cC0004%3a0%2cC0005%3a0; acct=t=AvAyyYd8QGe9gxmNZ%2b532Cw%2bRXXaKufR&s=gZdfsRt3%2fCTcqOZlWFD6mDi0ag97zYPV
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Connection: keep-alive
cache-control: public, max-age=300
content-type: application/atom+xml
expires: Wed, 19 Apr 2023 00:19:26 GMT
last-modified: Wed, 19 Apr 2023 00:14:26 GMT
strict-transport-security: max-age=15552000
x-frame-options: SAMEORIGIN
x-request-guid: 60b2e031-e2c3-4a30-bd6e-45d120c7a7a3
feature-policy: microphone 'none'; speaker 'none'
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com
Accept-Ranges: bytes
Date: Wed, 19 Apr 2023 00:14:26 GMT
Via: 1.1 varnish
X-Served-By: cache-chi-kigq8000178-CHI
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1681863266.268104,VS0,VE72
Vary: Fastly-SSL
X-DNS-Prefetch-Control: off
transfer-encoding: chunked

<feed redacted...

Nothing obviously wrong there. Immediately after, it sent the "featured" query:

GET /feeds/tag?tagnames=scp+or+ssh+or+sftp+or+jsch+or+openssh&sort=featured HTTP/1.1
Host: stackoverflow.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
If-Modified-Since: Tue, 18 Apr 2023 22:14:25 GMT
Connection: keep-alive
Cookie: prov=e40d4f1a-2756-bb71-0420-1c459f63cd61; OptanonAlertBoxClosed=2023-04-13T13:31:25.450Z; OptanonConsent=datestamp=2023-04-13+13%3a30%3a01Z&groups=C0001%3a1%2cC0002%3a0%2cC0003%3a0%2cC0004%3a0%2cC0005%3a0; acct=t=AvAyyYd8QGe9gxmNZ%2b532Cw%2bRXXaKufR&s=gZdfsRt3%2fCTcqOZlWFD6mDi0ag97zYPV
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Connection: keep-alive
cache-control: public, max-age=300
content-type: application/atom+xml
expires: Wed, 19 Apr 2023 00:19:26 GMT
last-modified: Wed, 19 Apr 2023 00:14:26 GMT
strict-transport-security: max-age=15552000
x-frame-options: SAMEORIGIN
x-request-guid: 5cafdceb-c480-48da-94d0-18f5c3f5c48d
set-cookie: acct=t&s; expires=Tue, 18 Apr 2023 00:14:26 GMT; domain=.stackoverflow.com; path=/; secure; samesite=none; httponly
feature-policy: microphone 'none'; speaker 'none'
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com
Accept-Ranges: bytes
Date: Wed, 19 Apr 2023 00:14:26 GMT
Via: 1.1 varnish
X-Served-By: cache-chi-kigq8000178-CHI
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1681863267.685116,VS0,VE31
Vary: Fastly-SSL
X-DNS-Prefetch-Control: off
transfer-encoding: chunked

<feed redacted...

This time it received a set-cookie which appears intended to invalidate the "acct" cookie.

I wasn't using the computer during this time. The only queries to SO captured by Proxyman after logging in were the Feedbro feed refreshes from my two profiles.

Edit: TylerH found a firefox bug involving cookies. The description in that ticket doesn't seem to match my experience and I don't think I'm experiencing that issue. But I updated FF to 112.0.1 and ran another test using my test profile. I restarted FF around 10:03 and forced Feedbro to update its feeds. It ran both queries with no obvious problems. Both queries included the "acct" cookie and neither response contained a set-cookie.

At 12:04 Feedbro refreshed the feeds on its own. Here's the first request/response:

GET /feeds/tag?tagnames=scp+or+ssh+or+sftp+or+jsch+or+openssh&sort=newest HTTP/1.1
Host: stackoverflow.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
If-Modified-Since: Wed, 19 Apr 2023 14:03:33 GMT
Connection: keep-alive
Cookie: prov=e40d4f1a-2756-bb71-0420-1c459f63cd61; OptanonAlertBoxClosed=2023-04-13T13:31:25.450Z; OptanonConsent=datestamp=2023-04-13+13%3a30%3a01Z&groups=C0001%3a1%2cC0002%3a0%2cC0003%3a0%2cC0004%3a0%2cC0005%3a0; acct=t=ba%2brNJZFrMvBJldpqdeFkHovB7e20pke&s=jC26Ls4%2fx67dOeM7fOgJgQzXawScd0i%2f
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Connection: keep-alive
cache-control: public, max-age=300
content-type: application/atom+xml
expires: Wed, 19 Apr 2023 16:09:04 GMT
last-modified: Wed, 19 Apr 2023 16:04:04 GMT
strict-transport-security: max-age=15552000
x-frame-options: SAMEORIGIN
x-request-guid: 0992ceb4-a52d-4056-b094-a62a2555ebba
feature-policy: microphone 'none'; speaker 'none'
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com
Accept-Ranges: bytes
Date: Wed, 19 Apr 2023 16:04:04 GMT
Via: 1.1 varnish
X-Served-By: cache-chi-kigq8000078-CHI
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1681920245.642614,VS0,VE70
Vary: Fastly-SSL
X-DNS-Prefetch-Control: off
transfer-encoding: chunked

<feed redacted...

And the second:

GET /feeds/tag?tagnames=scp+or+ssh+or+sftp+or+jsch+or+openssh&sort=featured HTTP/1.1
Host: stackoverflow.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
If-Modified-Since: Wed, 19 Apr 2023 14:03:45 GMT
Connection: keep-alive
Cookie: prov=e40d4f1a-2756-bb71-0420-1c459f63cd61; OptanonAlertBoxClosed=2023-04-13T13:31:25.450Z; OptanonConsent=datestamp=2023-04-13+13%3a30%3a01Z&groups=C0001%3a1%2cC0002%3a0%2cC0003%3a0%2cC0004%3a0%2cC0005%3a0; acct=t=ba%2brNJZFrMvBJldpqdeFkHovB7e20pke&s=jC26Ls4%2fx67dOeM7fOgJgQzXawScd0i%2f
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Connection: keep-alive
cache-control: public, max-age=300
content-type: application/atom+xml
expires: Wed, 19 Apr 2023 16:09:05 GMT
last-modified: Wed, 19 Apr 2023 16:04:05 GMT
strict-transport-security: max-age=15552000
x-frame-options: SAMEORIGIN
x-request-guid: c57ae837-dda8-4b94-9110-a8394850ae6c
set-cookie: acct=t&s; expires=Tue, 18 Apr 2023 16:04:05 GMT; domain=.stackoverflow.com; path=/; secure; samesite=none; httponly
feature-policy: microphone 'none'; speaker 'none'
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com
Accept-Ranges: bytes
Date: Wed, 19 Apr 2023 16:04:05 GMT
Via: 1.1 varnish
X-Served-By: cache-chi-kigq8000078-CHI
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1681920245.006810,VS0,VE30
Vary: Fastly-SSL
X-DNS-Prefetch-Control: off
transfer-encoding: chunked

<feed redacted...

As you can see the second response contains a set-cookie to invalidate "acct", and I'm logged out again.

Not sure how relevant this is. But I think every response I've seen that invalidates the "acct" cookie has been for the "featured" query, which happens to run second.

Edit: In my test profile I disabled the "newest" feed, leaving Feedbro to only refresh the "featured" feed every two hours. In my daily-use profile I did the opposite--disabled the "featured" feed and left the "newest" feed in place. Overnight while the computer was idle, both profiles had their "acct" cookies invalidated.

I left the computer alone around 21:30. At 21:54 Feedbro in the daily-use profile updated the "newest" feed with no obvious problem. Then at 23:54 it refreshed the feed again and got this response including a set-cookie which invalidated "acct":

HTTP/1.1 200 OK
Connection: keep-alive
cache-control: public, max-age=300
content-type: application/atom+xml
expires: Thu, 20 Apr 2023 03:59:03 GMT
last-modified: Thu, 20 Apr 2023 03:54:03 GMT
strict-transport-security: max-age=15552000
x-frame-options: SAMEORIGIN
x-request-guid: b0e1cf41-7a0a-42bf-83fb-d3579e48037e
set-cookie: acct=t&s; expires=Wed, 19 Apr 2023 03:54:03 GMT; domain=.stackoverflow.com; path=/; secure; samesite=none; httponly
feature-policy: microphone 'none'; speaker 'none'
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com
Accept-Ranges: bytes
Date: Thu, 20 Apr 2023 03:54:03 GMT
Via: 1.1 varnish
X-Served-By: cache-chi-kigq8000132-CHI
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1681962844.774555,VS0,VE62
Vary: Fastly-SSL
X-DNS-Prefetch-Control: off
transfer-encoding: chunked

The test profile refreshed its "featured" feed at 22:04 and 0:04 with no trouble either time. Then at 02:04 it refreshed the feed and got this response including another set-cookie invalidating "acct":

HTTP/1.1 200 OK
Connection: keep-alive
cache-control: public, max-age=300
content-type: application/atom+xml
expires: Thu, 20 Apr 2023 06:09:12 GMT
last-modified: Thu, 20 Apr 2023 06:04:12 GMT
strict-transport-security: max-age=15552000
x-frame-options: SAMEORIGIN
x-request-guid: a27dde32-f863-4161-b3db-7ff4f0c131ab
set-cookie: acct=t&s; expires=Wed, 19 Apr 2023 06:04:12 GMT; domain=.stackoverflow.com; path=/; secure; samesite=none; httponly
feature-policy: microphone 'none'; speaker 'none'
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com
Accept-Ranges: bytes
Date: Thu, 20 Apr 2023 06:04:12 GMT
Via: 1.1 varnish
X-Served-By: cache-chi-kigq8000109-CHI
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1681970652.120827,VS0,VE30
Vary: Fastly-SSL
X-DNS-Prefetch-Control: off
transfer-encoding: chunked

These were the only queries to SO during this period of time from this computer.

Edit: This morning I was able to reproduce this without Feedbro. In my test profile I disabled Feedbro, then opened two browser tabs and loaded one of the feed URLs into each. I originally logged back into SO on this profile around 07:46 local time. Then I queried the "featured" URL around 08:00 in a browser tab:

GET /feeds/tag?tagnames=scp+or+ssh+or+sftp+or+jsch+or+openssh&sort=featured HTTP/1.1
Host: stackoverflow.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: prov=e40d4f1a-2756-bb71-0420-1c459f63cd61; OptanonAlertBoxClosed=2023-04-13T13:31:25.450Z; OptanonConsent=datestamp=2023-04-13+13%3a30%3a01Z&groups=C0001%3a1%2cC0002%3a0%2cC0003%3a0%2cC0004%3a0%2cC0005%3a0; acct=t=WlzDFR2OYk9dCaQHXsJiWhQAG8N73Qu5&s=9j%2bF6ASnJmAXyD4cfq%2fTTu%2f%2bn04ThUwk
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/1.1 200 OK
Connection: keep-alive
cache-control: public, max-age=300
content-type: application/atom+xml
expires: Mon, 24 Apr 2023 12:05:25 GMT
last-modified: Mon, 24 Apr 2023 12:00:25 GMT
strict-transport-security: max-age=15552000
x-frame-options: SAMEORIGIN
x-request-guid: c798f1ec-f2ce-4a9f-9c43-e1c394b081cc
feature-policy: microphone 'none'; speaker 'none'
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com
Accept-Ranges: bytes
Date: Mon, 24 Apr 2023 12:00:25 GMT
Via: 1.1 varnish
X-Served-By: cache-chi-kigq8000145-CHI
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1682337626.597994,VS0,VE31
Vary: Fastly-SSL
X-DNS-Prefetch-Control: off
transfer-encoding: chunked

<?xml redacted...

The request contained the "acct" cookie and the response didn't contain any set-cookies. The only difference I can see here from a typical query by Feedbro is the accept header and the sec-fetch headers. The response body starts with a "<?xml" line instead of jumping right into the "<feed" element.

At 09:00 I queried both of the feed URLs in browser windows again. I did the "featured" query first:

GET /feeds/tag?tagnames=scp+or+ssh+or+sftp+or+jsch+or+openssh&sort=featured HTTP/1.1
Host: stackoverflow.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: prov=e40d4f1a-2756-bb71-0420-1c459f63cd61; OptanonAlertBoxClosed=2023-04-13T13:31:25.450Z; OptanonConsent=datestamp=2023-04-13+13%3a30%3a01Z&groups=C0001%3a1%2cC0002%3a0%2cC0003%3a0%2cC0004%3a0%2cC0005%3a0; acct=t=WlzDFR2OYk9dCaQHXsJiWhQAG8N73Qu5&s=9j%2bF6ASnJmAXyD4cfq%2fTTu%2f%2bn04ThUwk
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/1.1 200 OK
Connection: keep-alive
cache-control: public, max-age=300
content-type: application/atom+xml
expires: Mon, 24 Apr 2023 13:05:52 GMT
last-modified: Mon, 24 Apr 2023 13:00:52 GMT
strict-transport-security: max-age=15552000
x-frame-options: SAMEORIGIN
x-request-guid: 0d5e8617-b8fc-46aa-aa01-c7f161f69f46
feature-policy: microphone 'none'; speaker 'none'
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com
Accept-Ranges: bytes
Date: Mon, 24 Apr 2023 13:00:52 GMT
Via: 1.1 varnish
X-Served-By: cache-chi-kigq8000039-CHI
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1682341253.953074,VS0,VE33
Vary: Fastly-SSL
X-DNS-Prefetch-Control: off
transfer-encoding: chunked

<?xml redacted...

Then I did the "featured" query again:

GET /feeds/tag?tagnames=scp+or+ssh+or+sftp+or+jsch+or+openssh&sort=newest HTTP/1.1
Host: stackoverflow.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: prov=e40d4f1a-2756-bb71-0420-1c459f63cd61; OptanonAlertBoxClosed=2023-04-13T13:31:25.450Z; OptanonConsent=datestamp=2023-04-13+13%3a30%3a01Z&groups=C0001%3a1%2cC0002%3a0%2cC0003%3a0%2cC0004%3a0%2cC0005%3a0; acct=t=WlzDFR2OYk9dCaQHXsJiWhQAG8N73Qu5&s=9j%2bF6ASnJmAXyD4cfq%2fTTu%2f%2bn04ThUwk
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/1.1 200 OK
Connection: keep-alive
cache-control: public, max-age=300
content-type: application/atom+xml
expires: Mon, 24 Apr 2023 13:06:01 GMT
last-modified: Mon, 24 Apr 2023 13:01:01 GMT
strict-transport-security: max-age=15552000
x-frame-options: SAMEORIGIN
x-request-guid: be93034f-c678-4d17-9446-8eef1a253226
set-cookie: acct=t&s; expires=Sun, 23 Apr 2023 13:01:01 GMT; domain=.stackoverflow.com; path=/; secure; samesite=none; httponly
feature-policy: microphone 'none'; speaker 'none'
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com
Accept-Ranges: bytes
Date: Mon, 24 Apr 2023 13:01:01 GMT
Via: 1.1 varnish
X-Served-By: cache-chi-kigq8000039-CHI
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1682341262.725055,VS0,VE75
Vary: Fastly-SSL
X-DNS-Prefetch-Control: off
transfer-encoding: chunked

<?xml 

The response to the second query contained a set-cookie for "acct" and I'm logged out again in that profile.

21
  • Did you redact the acct cookie in the response or was t&s all you got?
    – rene
    Commented Apr 18, 2023 at 14:24
  • I didn't alter the set-cookie lines in the response. I suppose the server was intentionally trying to expire/remove those cookies.
    – Kenster
    Commented Apr 18, 2023 at 14:25
  • 3
    I'm looking for other similar reports over the last few months, I have seen a few but none of those were able to pinpoint the root cause. Your acct cookie getting expired is a problem as that is, as you mentioned, indeed needed for universal login
    – rene
    Commented Apr 18, 2023 at 14:28
  • 3
    MSE possible related: I keep getting logged out of Stack Overflow
    – rene
    Commented Apr 18, 2023 at 14:33
  • 3
    This does look a lot like the server is intentionally invalidating the cookie. I checked our account session logs and yours are being invalidated due to a token mismatch, which suggests to me that the extension is perhaps sending a stale cookie somehow?
    – Adam Lear StaffMod
    Commented Apr 18, 2023 at 19:41
  • 1
    Firefox v112 had a bug that set incorrect timestamps for cookie expiration, causing them to expire early. Update to 112.0.1 and see if that fixes your issue (it was the only change in 112.0.1). Reference bug: bugzilla.mozilla.org/show_bug.cgi?id=1827669
    – TylerH
    Commented Apr 19, 2023 at 13:51
  • 1
    I think I have the exact same issue as OP although I am using Brave browser on Ubuntu 20.04. I have also the FeedBro extension installed.
    – s.ouchene
    Commented Apr 24, 2023 at 8:08
  • I have the same issue. I started following an RSS feed from SO using the Brief reader in Firefox. I now have to log in sveral times a day and sometimes deal with Captchas. I have a RSS feed for Unix Stackexchange also; that does not log me out, only SO.
    – Kaz
    Commented Jul 5, 2023 at 8:12
  • Any ideas? What is the solution? Why is it only StackOverflow which has this problem, and not the Unix Stackexchange from which I'm also pulling an RSS feed?
    – Kaz
    Commented Jul 6, 2023 at 23:22
  • @Kaz I don't have any solution. I set my reader plugin to refresh less often, but I still experience the problem a few times per day. I'm not aware of any activity by SO aside from the comments on this post.
    – Kenster
    Commented Jul 7, 2023 at 19:35
  • @Kenster Is this caused because the RSS feeds are being pulled by the same browser which holds the authentication cookies? The RSS items do not require authentication; the feeds work without the login. It doesn't make any sense.
    – Kaz
    Commented Jul 7, 2023 at 19:41
  • I mean... getting rid of the rss feeds seems like it'd be the most effective way of solving this problem. changing how often they run will only change how often you have problems, it won't fix it.
    – Kevin B
    Commented Jul 7, 2023 at 19:45
  • Never mind, I read this in more detail. Basically, RSS feed requests are receiving a response which obliterates the authentication cookie due to a funny date.
    – Kaz
    Commented Jul 7, 2023 at 19:48
  • I wonder whether accepting that cookie header and deleting the cookie is done by some lower level objects/API's in the browser, so that the RSS extension is oblivious to it. Or could the RSS extension use the API in such a way that cookies are ignored? Pulling an RSS feed does not require cookies; it is stateless. The RSS items themselves contain persistent identifiers in order to track updated items or reject duplicate items (or items the user has deleted) and such.
    – Kaz
    Commented Jul 7, 2023 at 19:49
  • 2
    I wrote the feedbro author in April and pointed him to this post. He responded in email that feedbro wasn't doing anything special with its feed requests; it just triggers requests and the browser does all of the processing it normally does with a request, including cookie processing. I think it's significant that a different rss plugin can trigger the same problem. And I'll point out that I was able to reproduce the problem by loading and reloading the feed URLs in browser tabs instead of the feed reader.
    – Kenster
    Commented Jul 7, 2023 at 20:11

0

You must log in to answer this question.

Browse other questions tagged .