Cache issues? Suddenly logged in as a different user

[2984839]

I was logged in and had MR open in a tab, closed it, went somewhere else, then came back and was logged in as somebody else. Reloading the page did not resolve it; I had to actually login as myself to even post this. Similar to the behavior reported here: https://forums.macrumors.com/thread...s-on-tff.2235516/?post=28463671#post-28463671

Screenshot below.

 

[arn]

Was it a new private browser window? Would being logged out have been expected behavior?

Any extensions in Safari?

thanks
arn

 

[2984839]

Was it a new private browser window? Would being logged out have been expected behavior?

Any extensions in Safari?

thanks
arn

It was the same window, but a different tab. I had closed the one I was using, then 2-3 minutes later opened a new one and went directly to forums.macrumors.com from the URL bar, so I should still have been logged in. This was all in private browsing mode, and only extension is AdGuard.

edit: Doing the same thing again (close the MR tab, open a new blank tab, go directly to MR) now just leaves me logged out.

 

[arn]

Hmm... how's that work? I opened a new Private window and logged in. When I open a new tab in that logged-in window, I'm logged out.

arn

 

[2984839]

Hmm... how's that work? I opened a new Private window and logged in. When I open a new tab in that logged-in window, I'm logged out.

arn

I think that's a Safari private browsing mode bug. It's happening with Github for me too.

 

[arn]

Not sure how familiar you are with Safari developer menu. But if you can reproduce it, the Response Headers would be super helpful on the wrongly logged in page.

Safari -> Develop -> Show Page Resources

I need to look closer at Adguard and see if it's behaving unexpectedly. A logged in user should never be cached, but obviously there is somewhere that's not happening correctly.

 

[D.T.]

Generally how this authentication works is the client (browser) stores a token, that's transmitted to the server (usually in the header), and that's looked up in a table (usually as part of some middleware service), where it does all the account specific data fetch (username, alerts, etc.,) by way of the token_to_userid relationship.

This sounds like the user's token was in use by another account, like it got recycled - usually it's some kind of GUID so it's highly improbable. Logging in generates a new, active token so it get's resolved.

I guess if there's a cache service in between, but usually that's only for the static assets (like logos, HTML, etc.)

 

[2984839]

So this just happened again, this time I was logged in as GregL385.
Browser: Firefox 81.0.2 on OpenBSD. Only extension is uBlock Origin

This time, clicking anywhere logged me out. Unfortunately, I forgot to grab the response headers, but I'll keep an eye out for this and do that next time.

 

[max2]

Interesting!

I wish I could tell you why.

 

[arn]

we made a change that I hope will prevent this in the future