1109199 - Silent log out while editing new a page loses all your work

Status: RESOLVED FIXED

(developer.mozilla.org Graveyard :: Editing, defect)

Description

[Eric Shepherd [:sheppy]]

What did you do?
================
1. Navigated to a non-existent page to begin writing content.
2. Wrote a good bit of text.
3. Clicked Save.

What happened?
==============
At some point while I was working, my login was dropped. When I clicked the save button, I was presented with a "You have to login to do that" page. After logging in, I was returned to the "New page" editor, with my content lost.

What should have happened?
==========================
Editor content needs to be retained across a login request, or login drops have to stop happening. The former is probably easier to deal with, but I don't know. At any rate, the key thing is that writers should never lose work due to a login drop.

Is there anything else we should know?
======================================

Comment 1

[Māris Fogels [:mars] (please needinfo)]

:groovecoder, Sheppy says that the session drop issues are less frequent (presumably since we upgraded to django-allauth), but they are still happening.  Any idea what's going on?

Comment 2

[Luke Crouch [:groovecoder]]

Sounds like something the draft editor should fix? When you get back to the "New page" editor, do you not have the ability to "Restore draft"?

We expire session IDs as a security measure [1]. How often are these login drops happening? Hourly vs. daily vs. weekly? The django-allauth default SESSION_COOKIE_AGE is 3 weeks. IIRC the sessions are also associated with certain user agents, which means switching between browser versions will also expire the session. So, need more information about how the session is being dropped to see if there's a bug.

[1] https://en.wikipedia.org/wiki/Session_fixation#Time-out_old_SIDs

Comment 3

[Eric Shepherd [:sheppy]]

(In reply to Luke Crouch [:groovecoder] from comment #2)
> Sounds like something the draft editor should fix? When you get back to the
> "New page" editor, do you not have the ability to "Restore draft"?
> 
> We expire session IDs as a security measure [1]. How often are these login
> drops happening? Hourly vs. daily vs. weekly? The django-allauth default
> SESSION_COOKIE_AGE is 3 weeks. IIRC the sessions are also associated with
> certain user agents, which means switching between browser versions will
> also expire the session. So, need more information about how the session is
> being dropped to see if there's a bug.
> 
> [1] https://en.wikipedia.org/wiki/Session_fixation#Time-out_old_SIDs

Not for new pages; the draft saving feature doesn't seem to work for them.

I've not been able to detect a pattern to when the login sessions drop. But they shouldn't be allowed to while you're in the middle of an edit (at least not if you're actively using it).

Comment 4

[Luke Crouch [:groovecoder]]

So I filed a couple of bugs under this one:

* Add/fix draft-saving feature on "New Page" (bug 1114649)
* Investigate & fix session expirations (bug 1114650)

Comment 5

[Stephanie Hobson [:shobson]]

Possibly fixed by Bug 1268609 which should be in production later this week.

After that's in production the next step with this is to determine if this is still a problem.

Comment 6

[Stephanie Hobson [:shobson]]

The draft is now retained and can be recovered after the user logs back in.