702844 - sometimes getting wrong person logged in on caseconductor.allizom.org

Status: RESOLVED INCOMPLETE

(Infrastructure & Operations Graveyard :: WebOps: Other, task)

Description

[Cameron Dawson [:camd]]

Shyam,

Earlier today, when I navigated to this site, I was mysteriously logged in as you (Shyam).  Then later, John Hammink got the same thing, except logged in as me.  He didn't log in, he just WAS ALREADY logged in when he navigated there.

Carl and I were both puzzled by this and not quite sure what could cause it.  He asked:
[carljm:] do they have some kind of full-page caching layer in front of it that I don't know about? 
... 
because i'm quite sure we're sending the appropriate Vary: Cookie header

Writing a bug instead of email, so we can track this.

Comment 1

[Shyam Mani [:fox2mike]]

We do have Zeus in front of this site and caching, we have to (or your performance will drop).

I'm going to be away for the next week, there's Mozcamp Asia etc, so I'm not sure I can look into this until late next week at the earliest.

These are the headers :

fox2mike@woodpecker ~ $ curl -I -L "https://caseconductor.allizom.org/"
HTTP/1.1 302 FOUND
Server: Apache/2.2.15 (Red Hat)
Vary: Cookie, Accept-Encoding
X-Backend-Server: node200
Content-Type: text/html; charset=utf-8
strict-transport-security: max-age=86400
Date: Wed, 16 Nov 2011 04:40:51 GMT
Location: https://caseconductor.allizom.org/account/login/?next=%2F
Transfer-Encoding: chunked
Connection: Keep-Alive
Set-Cookie: messages="a9bbd8eaf18e9e6af18ddc63d5f37180d3b141b7$[[\"__json_message\"\05420\054\"Please log in to view this page.\"]]"; Path=/
x-frame-options: DENY
X-Cache-Info: not cacheable; response is 302 without expiry time

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Red Hat)
Vary: Cookie, Accept-Encoding
X-Backend-Server: node200
Content-Type: text/html; charset=utf-8
strict-transport-security: max-age=86400
Date: Wed, 16 Nov 2011 04:40:51 GMT
Transfer-Encoding: chunked
Connection: Keep-Alive
Set-Cookie: csrftoken=f4e9a65f360ade37a911f26322fce7a3; expires=Wed, 14-Nov-2012 04:40:51 GMT; Max-Age=31449600; Path=/
x-frame-options: DENY
X-Cache-Info: caching

I'm going to toss this back into the queue, someone else from Webops should also be able to help.

Comment 2

[Jeremy Orem [:oremj]]

I'm not able to reproduce. If you can still produce this please capture and paste the full headers.

Comment 3

[Jeremy Orem [:oremj]]

Please reopen when comment 2 is ready.