590843 - (cookiemonster3) Investigate cookie loss on trunk

Status: RESOLVED FIXED

(Core :: Networking: Cookies, defect)

Description

[[e-mail]]

There has been anecdotal evidence of a cookie problem recently -- people getting logged out of services. Happens again after clearing cookies. Figuring out how recently this started happening, how often it happens, and how it manifests (mass signout all at once? A trickle?) would be a good start.

There is speculation that this could be Sync related. Turning it off for a while would be a good way to test that theory.

Comment 1

[Mike Connor [:mconnor]]

Sync doesn't touch cookies in any way.  http://mxr.mozilla.org/services-central/search?string=cookie&find=/fx-sync/

I don't know the basis for this theory, but I really don't know how turning off Sync would prove anything.

Comment 2

[[e-mail]]

Sync just handles cookie prefs? I thought it sunc cookies as well.

Seems much less likely as a culprit, then.

beltzer, are restarts (i.e. sessionstore) a part of your routine? Assuming the answer is yes, can you reproduce without restarting?

Comment 3

[Mike Beltzner [:beltzner, not reading bugmail]]

mconnor: sorry for the red herring; are there any things Sync does synchronize (passwords? history?) which might affect how session cookies work?

dwitte: I restart every day or so for updates, yeah, and know that formerly those were considered part of the same "session" for the purposes of cookies. Did we change that? I know that Lucas and some of the other security folks were indeed agitating to do so.

Comment 4

[[e-mail]]

We didn't change it. I'm thinking it could be something to do with how sessionstore adds session cookies back on restart. It'd be helpful to eliminate that possibility, but it's really just a strawclutch until we get more data...

Comment 5

[[e-mail]]

(Actually, adding zpao to cc, just in case he knows of any recent sessionstore changes that could affect this.)

Comment 6

[Paul O'Shannessy [:zpao] (not bugmail, email directly)]

(In reply to comment #5)
> (Actually, adding zpao to cc, just in case he knows of any recent sessionstore
> changes that could affect this.)

You and Shawn were last to touch the cookie stuff in sessionstore, so you'd probably be able to answer that better than me! We're not doing anything fancy, so it should be pretty obvious if something is wrong there.

Comment 7

[[e-mail]]

I'd like to get a blocking+ for investigation -- this might take a bit of time to figure out, so I'd like to make it a priority, and I think we need an answer here by release time.

Comment 8

[LegNeato]

I know someone that has this happening in b4. Updating to b5 didn't help. I'm sure she would be willing to help. FYI, she isn't using sync.

Comment 9

[[e-mail]]

Cool. Put her in touch?

Comment 10

[LegNeato]

CC'd her. I'll also ping her offline.

Comment 11

[kjc5]

I was seeing this happening in 4.0b4, but when I ugraded to 4.0b5 it seemed to solve the issue. However after about a day, started seeing the issue again across all new tabs I opened and in already open tabs. Esp prevalent in Google Apps, where I would notice some of my previously open spreadsheets or docs would have redirected to the login page. Also, my work has a single sign on process for all internal pages, yet I have had to re-log on for every new tab I open. Clearing cookies didn't solve the issue in 4.0b4, but I will try it again now and see if I get a different result.

Comment 12

[[e-mail]]

OK. Getting a log here would be a good first step. Instructions are at https://developer.mozilla.org/en/Creating_a_Cookie_Log ... before you do that, clear all your cookies, then turn on logging and browse around. Once you notice some cookie loss, note what site it was on, then send me the log. (You probably don't want to attach it here, since it might contain personal info.)

Thanks!

Comment 13

[Benjamin Smedberg]

I see missing cookies from washingonpost pretty regularly on my home machine, so I will try to provide a cookie log when I get back there. It might take a couple days.

Comment 14

[[e-mail]]

I've also noticed loss on one or two sites. I've kicked off a cookie log, but it'll probably be a few days before I see anything.

Comment 15

[[e-mail]]

Is anyone here using PB mode, by chance? And even better, has noticed that this occurs after or around a PB mode switch, or starting the browser into PB?

Comment 16

[[e-mail]]

Bug 591447 *might* fix this. Once that lands I'd like to see what happens and mark this as appropriate.

Comment 17

[Johnathan Nightingale [:johnath]]

So, fwiw, this seemed to happen to me today. I say seemed, because I woke up and had to log back in to yelp, wikimo, flickr, and gmail, none of whom should have hit legitimate expiry thresholds (assuming the sites refresh them on activity).

Having said that - looking at my list of cookies reveals plenty, including ones I'm sure I haven't refreshed, like airchina cookies from 2 weeks ago. So perhaps the cookies aren't expunged, but are just not being presented? Dunno - wish I had more information to offer. This was after a weekend suspended, and a month boundary rollover (November 1st today) neither of which may have anything to do with anything.

Comment 18

[[e-mail]]

That's actually quite helpful. It indicates to me that it's a problem related to purging, somehow -- since it affects multiple sites at once, and you haven't lost *all* your cookies, which would be a symptom of a corrupt database or somesuch.

(This *could* still be corruption, but that is... somewhat unlikely.)

Since this appears quite sporadic, I'll just go inspect the purge code and see what I can see...

Comment 19

[[e-mail]]

Attachment: patch

I have no idea if this will fix what people are seeing, but I found two bugs in purge code. The test changes make them fairly self-explanatory.

Comment 20

[Shawn Wilsher :sdwilsh]

Comment on attachment 488124 [details] [diff] [review]
patch

r=sdwilsh

Comment 21

[[e-mail]]

Comment on attachment 488124 [details] [diff] [review]
patch

http://hg.mozilla.org/mozilla-central/rev/d1649deec025

Comment 22

[[e-mail]]

Attachment: part 2

Thanks to Neil for catching the warning on MSVC that fingered the problem. (According to C spec, integer literals are required to be 'int' or larger IIRC; my 64-bit gcc happily promotes them to 64-bit and thus doesn't warn, but other compilers may well not. Like 32-bit mac gcc.)

Comment 23

[Shawn Wilsher :sdwilsh]

Comment on attachment 489967 [details] [diff] [review]
part 2

r=sdwilsh

Comment 24

[[e-mail]]

Comment on attachment 489967 [details] [diff] [review]
part 2

http://hg.mozilla.org/mozilla-central/rev/bbf2de2368f4

Comment 25

[[e-mail]]

This almost certainly fixes this bug. Marking as such!