What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

I stay logged into SO from multiple computers at my location using my Google ID.

Today, for some reason, multiple times from the same multiple computers, I'm getting repeatedly bumped out and having to click the "login" link. Selecting the "Google ID" icon gets me back in quickly.

Not really a big deal, but very unusual to have this happen many times in one day after staying logged in for many days/months/etc. without this issue.

EDIT 2/13/13: I've un-accepted my answer from below because this issue continues worse than ever. I've been kicked out at least eight times today from each of my computers.

EDIT 2/14/13: What do we need to do to get some attention to this problem?... (EDIT: the tone is not meant any other way than how it's written... I honestly want to know how to properly report this problem) today it's much worse than yesterday, I'm getting bumped out hourly now. I've un-accepted my answer and that didn't work, but posting a new question would not be proper.

EDIT 2/22/13: Starting to notice a pattern. If I move from one machine to another, I get bumped out of the previous machine. So it appears that the real issue is that I cannot stay logged in from multiple locations simultaneously. Again, previous to 2/9/13, staying logged in indefinitely from as many locations as I wished was never an issue. So what can be done? I'm not going to abuse this site by posting multiple threads, but this seems to be getting no attention from anyone that cares to investigate.

EDIT 2/27/13: Still happening very frequently. Today I created and added a new "Stack Exchange" login to my account and stopped using my Google ID. I dumped my cache and all cookies. That was only a couple of hours ago, and I've already been logged out three times since. That also blows my 2/22 theory out of the water since I've stayed with one machine this whole time too.

share|improve this question
3  
Same issue here, getting logged out silently every hour or so. –  Shadow Wizard Feb 10 '13 at 12:43
1  
Yes, this keeps happening to me, too, and I don’t use Google for authentication. –  tchrist Feb 14 '13 at 3:23
    
Afaik, it started around 2/8 US time for me. –  Troyen Feb 14 '13 at 5:29
    
I get the same problem with Chrome and Google ID. –  Motti Feb 17 '13 at 8:50
    
Re the 22/2 edit, I'm getting the problem while using the same computer and it's a real pain. –  Motti Feb 26 '13 at 13:03
1  
Same issue here - logged out frequently (still persists). Using Chrome and Google ID. Been happening for several weeks. Only happens on ServerFault for me (which is the site I frequent) - I remain logged into all other SE sites. Interestingly, I stay logged in at work (using an older version of Chrome portable and the same Google ID). Problem has persisted across browser restarts, computer restarts, cache/cookie clears, and intentionally logging out of both Google and SF. –  cyberx86 Feb 27 '13 at 15:54
1  
This has been happening to me. I only stay logged in for about 5 mins. Using yahoo. –  ravenspoint Feb 28 '13 at 13:01
1  
This now seems to be fixed. –  ravenspoint Mar 1 '13 at 15:12

4 Answers 4

up vote 10 down vote accepted

We refresh your authentication cookie pretty aggressively to help deter theft - this refresh can happen on any url that needs to know who you are.

I introduced a bug that would access a user's cookie on routes that didn't need it, e.g. a feed of bug questions. The access happened after headers had already been sent, meaning the cookie refresh couldn't take place. Subsequent requests now had invalid cookies and a logout was forced.

I apologize and a fix will be pushed shortly.

I'm also refunding Sha Wiz Dow Ard's bounty.

share|improve this answer
1  
THANK-YOU! I was beginning to think this would never stop. lol. –  Sparky Feb 28 '13 at 20:27
    
Awesomeness in its best! Wonder how come we didn't see LOT more reports of this sort then? As for bounty I could have given this to you, it served its purpose after all (by luring you here :)) and you deserve it rightfully. ;) –  Shadow Wizard Feb 28 '13 at 20:44
    
@ShaWizDowArd the cookie is rotated after a set amount of time and most of your requests were to the "normally authenticated" pages, so it wouldn't (thankfully) occur that much. –  Jarrod Dixon Feb 28 '13 at 20:50
    
This sounds right. I am monitoring the RSS feed of questions on a couple of topics, and the logout frequency is about right for the RSS poll frequency. –  ravenspoint Feb 28 '13 at 22:29
    
Yes! I reduced the frequency of RSS refreshing, and I can stay logged in for a sensible length of time. +1 vote –  ravenspoint Feb 28 '13 at 23:09
    
@ShaWizDowArd, probably because 95+% of the users don't keep a window open or stay here very long. Then of the remaining users, most people won't take the time to complain. Thankfully, your 500 rep bounty got the needed attention and I'm wondering how this would have played out otherwise... a few days ago, my OP was 2 votes away from being closed as "too localized". lol. –  Sparky Mar 1 '13 at 18:35
    
Cheers @Sparky glad my rep is being used for a good cause! :-) –  Shadow Wizard Mar 1 '13 at 18:59
    
Jarrod, in the future, what do you recommend one should do when a bug like this is found and the meta OP goes ignored for several weeks? Thanks. –  Sparky Mar 1 '13 at 19:04
    
@Sparky I would suggest trying to add more debugging info - it wasn't the bounty that Sha Wiz Dow Ard added that got my attention, it was the excellent video in his answer that showed there was an issue. –  Jarrod Dixon Mar 1 '13 at 19:06
    
In this case, I provided every detail that I could think of... it just seemed very random and frequent. –  Sparky Mar 1 '13 at 19:08
    
@Sparky you did all you could, as it was a very insidious bug; it really didn't help that we were moving data centers (which clouds lots of bug reports). Sorry it took me so long to notice the issue! –  Jarrod Dixon Mar 1 '13 at 19:11
    
I'm glad it got fixed... I was mostly just concerned that I followed standard procedure in reporting it. Thanks again. –  Sparky Mar 1 '13 at 19:16
    
Just (very) curious: what do you use to revalidate the cookie then, in a way that this won't work in the browser of a cookie thief? Are you using se:fkey from Local Storage to sign a renewal request? And does this imply that Why doesn't the Stack Overflow team fix the Firesheep style cookie theft? is status-completed-as-far-as-we'll-be-fixing-it? –  Arjan Mar 1 '13 at 19:20
1  
@Arjan we use a variant of this series/token cycling technique - when we get an invalid pair, we destroy the session, so a theft could only last for a few minutes (provided the account owner is still browsing). Our sysadmins are working on HTTPS now; I'm not sure the time frame, though. –  Jarrod Dixon Mar 1 '13 at 19:34

Learning about today's (2/9/13) planned outage explained a lot. The constant logout problems I experienced yesterday had a timeline similar to the activities described here:

http://stackstatus.net/post/42602026025/succeeding-back-to-new-york-feb-9-2013

share|improve this answer

OK, I have this exact same thing going on for about the same time.

First of all, live demonstration:

http://www.youtube.com/watch?v=LXLLuDTBQsg

Now for my insights.

  1. It happens only on this very Meta site.
  2. It happens only if I leave the browser inactive for about 10-15 minutes in the site home page, if I'm inside a question it's not happening.
  3. The real time updates (i.e. web socket connection) still works during this whole time, I see inbox items pop and "x new items with new activity" ever increasing.
  4. Trying to access the inbox results in error as expected.
  5. Refreshing the home page isn't logging me in automatically, just going to the login page itself.
  6. I have tried using Facebook OpenID instead of Google. No change.
share|improve this answer
    
I can verify every single step except item #1... it's happening to me on SO as well as Meta. And I never leave my browser open to Meta, so it only happens there on every new visit. Items 2, 3, 4, 5, & 6... yes, yes, yes, yes and yes! –  Sparky Feb 28 '13 at 15:34
    
Weird, what tab you browse on Stack Overflow? Tag specific page perhaps? –  Shadow Wizard Feb 28 '13 at 15:35
    
Most of the time on SO, I just click the SO icon and browse whatever questions are there. Although one time, I got an error trying to post a comment on a question because I had been logged out. –  Sparky Feb 28 '13 at 15:36

I think Google may have been doing some maintenance today. I got booted from Google Apps several times today. Hope they fixed whatever it is they where trying to fix.

share|improve this answer
    
Whatever it is, it happened twice more since your response. –  Sparky Feb 9 '13 at 3:00
1  
Google doing maintenance wouldn't cause anybody to get logged out of Stack Overflow. –  balpha Feb 9 '13 at 8:41
2  
It's been happening to me, and I don't use Google for my open ID. –  Andrew Grimm Feb 10 '13 at 10:16
1  
@balpha since yesterday I keep getting kicked out every hour and have to log in again. It happens only here on Meta. anything on your side might cause it? –  Shadow Wizard Feb 11 '13 at 7:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .