This is a security issue. If an admin logs in on a public computer - like in a library or in their office's common area - they try to log out but don't notice that they didn't: then the next person using that machine has admin rights on WP which they probably aren't entitled to.

Seeing as this seems to be an issue with the CentralAuth function, adding two associated projects.

Probably related: T124406

It's presumably related to the session updates in .11

I can logout fine from enwiki, FWIW, as can other people

I can logout as well, FWIW. The issue clearly exists though.

Also reproduced in enwiki, zhwiki, wikidatawiki, metawiki, mediawikiwiki. However logging out at loginwiki probably don't have this problem.

What's going on here is that logging out on a wiki other than loginwiki isn't invalidating the session that exists on loginwiki, so CentralAuth's "auto-login if you're logged in on loginwiki" code is immediately logging you back in.

I can't reproduce in my normal Firefox profile because apparently I have some cookie setting that breaks that CA auto-login, but I can reproduce on a newly-created profile.

I'm working on a fix for it now.

In T124409#1955349, @Anomie wrote:

I can't reproduce in my normal Firefox profile because apparently I have some cookie setting that breaks that CA auto-login, but I can reproduce on a newly-created profile.

Cannot replicate this on the (latest) Firefox either.

Per suggestion at ANI:
Also, then, to prevent a 'probable' disaster, could all sessions be invalidated on server-side.

In T124409#1955532, @Ankit-Maity wrote:

Per suggestion at ANI:
Also, then, to prevent a 'probable' disaster, could all sessions be invalidated on server-side.

Then what? They log in again, and we're back to square one?

There will be either a fix, or a rollback to .10 until we have a fix

Change 265748 had a related patch set uploaded (by Anomie):
SessionManager: Add SessionBackend::setProviderMetadata()

https://gerrit.wikimedia.org/r/265748

Change 265749 had a related patch set uploaded (by Anomie):
SessionManager: Track whether the session is supposed to be CA or Local

https://gerrit.wikimedia.org/r/265749

Change 265750 had a related patch set uploaded (by Anomie):
SessionManager: Add SessionBackend::setProviderMetadata()

https://gerrit.wikimedia.org/r/265750

Change 265751 had a related patch set uploaded (by Anomie):
SessionManager: Track whether the session is supposed to be CA or Local

https://gerrit.wikimedia.org/r/265751

In T124409#1955561, @Reedy wrote:

In T124409#1955532, @Ankit-Maity wrote:

Per suggestion at ANI:
Also, then, to prevent a 'probable' disaster, could all sessions be invalidated on server-side.

Then what? They log in again, and we're back to square one?

There will be either a fix, or a rollback to .10 until we have a fix

Correct, maybe after the fix.

Change 265750 merged by jenkins-bot:
SessionManager: Add SessionBackend::setProviderMetadata()

https://gerrit.wikimedia.org/r/265750

In T124409#1955792, @Ankit-Maity wrote:

In T124409#1955561, @Reedy wrote:

In T124409#1955532, @Ankit-Maity wrote:

Per suggestion at ANI:
Also, then, to prevent a 'probable' disaster, could all sessions be invalidated on server-side.

Then what? They log in again, and we're back to square one?

There will be either a fix, or a rollback to .10 until we have a fix

Correct, maybe after the fix.

Yes, maybe after. Doing it before would've been pointless if they logged in again

Change 265751 merged by jenkins-bot:
SessionManager: Track whether the session is supposed to be CA or Local

https://gerrit.wikimedia.org/r/265751

Change 265748 merged by jenkins-bot:
SessionManager: Add SessionBackend::setProviderMetadata()

https://gerrit.wikimedia.org/r/265748

Change 265749 merged by jenkins-bot:
SessionManager: Track whether the session is supposed to be CA or Local

https://gerrit.wikimedia.org/r/265749

We're rolling back to wmf.10 right now.

Happened to me a single time, incognito Chrome, enwiki I believe? I had lots of windows open and I closed the one accidentally :-/ I logged in, then out, and the CentralAuth autologin thingie immediately replaced the user toolbar on the login screen.

Tried to reproduce but could not; I don't think I did anything differently. I think this was the first time I used that test account since @Anomie patched CentralAuth so my guess is the stored metadata did not have a source key and that made the metadata merge successful. (I still only half-understand that stuff so chances are that's a stupid guess :)

We have now rolled back all wikis to 1.27-wmf.10. This issue should be gone now (/me crosses fingers). We'll work on resolving this and moving forward next week.

In T124409#1958561, @Tgr wrote:

I think this was the first time I used that test account since @Anomie patched CentralAuth so my guess is the stored metadata did not have a source key and that made the metadata merge successful. (I still only half-understand that stuff so chances are that's a stupid guess :)

That sounds like a good guess to me.

In T124409#1958564, @greg wrote:

We have now rolled back all wikis to 1.27-wmf.10.

:(

1.27.0-wmf.11 is back on group1 (everything but the wikipedias) as of 2016-01-27T19:14. Please be on the lookout for any recurrence of the prior logout issues and report back here if you feel that you can reproduce.