28

I stay logged into SO from multiple computers at my location using my Google ID.

Today, for some reason, multiple times from the same multiple computers, I'm getting repeatedly bumped out and having to click the "login" link. Selecting the "Google ID" icon gets me back in quickly.

Not really a big deal, but very unusual to have this happen many times in one day after staying logged in for many days/months/etc. without this issue.

EDIT 2/13/13: I've un-accepted my answer from below because this issue continues worse than ever. I've been kicked out at least eight times today from each of my computers.

EDIT 2/14/13: What do we need to do to get some attention to this problem?... (EDIT: the tone is not meant any other way than how it's written... I honestly want to know how to properly report this problem) today it's much worse than yesterday, I'm getting bumped out hourly now. I've un-accepted my answer and that didn't work, but posting a new question would not be proper.

EDIT 2/22/13: Starting to notice a pattern. If I move from one machine to another, I get bumped out of the previous machine. So it appears that the real issue is that I cannot stay logged in from multiple locations simultaneously. Again, previous to 2/9/13, staying logged in indefinitely from as many locations as I wished was never an issue. So what can be done? I'm not going to abuse this site by posting multiple threads, but this seems to be getting no attention from anyone that cares to investigate.

EDIT 2/27/13: Still happening very frequently. Today I created and added a new "Stack Exchange" login to my account and stopped using my Google ID. I dumped my cache and all cookies. That was only a couple of hours ago, and I've already been logged out three times since. That also blows my 2/22 theory out of the water since I've stayed with one machine this whole time too.

Improve this question
8
  • 3
    Same issue here, getting logged out silently every hour or so.
    – Shadow Wizard
    Commented Feb 10, 2013 at 12:43
  • 1
    Yes, this keeps happening to me, too, and I don’t use Google for authentication.
    – tchrist
    Commented Feb 14, 2013 at 3:23
  • Afaik, it started around 2/8 US time for me.
    – Troyen
    Commented Feb 14, 2013 at 5:29
  • I get the same problem with Chrome and Google ID.
    – Motti
    Commented Feb 17, 2013 at 8:50
  • Re the 22/2 edit, I'm getting the problem while using the same computer and it's a real pain.
    – Motti
    Commented Feb 26, 2013 at 13:03
  • 1
    Same issue here - logged out frequently (still persists). Using Chrome and Google ID. Been happening for several weeks. Only happens on ServerFault for me (which is the site I frequent) - I remain logged into all other SE sites. Interestingly, I stay logged in at work (using an older version of Chrome portable and the same Google ID). Problem has persisted across browser restarts, computer restarts, cache/cookie clears, and intentionally logging out of both Google and SF.
    – cyberx86
    Commented Feb 27, 2013 at 15:54
  • 1
    This has been happening to me. I only stay logged in for about 5 mins. Using yahoo.
    – ravenspoint
    Commented Feb 28, 2013 at 13:01
  • 1
    This now seems to be fixed.
    – ravenspoint
    Commented Mar 1, 2013 at 15:12

4 Answers 4

Reset to default
10

We refresh your authentication cookie pretty aggressively to help deter theft - this refresh can happen on any url that needs to know who you are.

I introduced a bug that would access a user's cookie on routes that didn't need it, e.g. a feed of bug questions. The access happened after headers had already been sent, meaning the cookie refresh couldn't take place. Subsequent requests now had invalid cookies and a logout was forced.

I apologize and a fix will be pushed shortly.

I'm also refunding Sha Wiz Dow Ard's bounty.

Improve this answer
14
  • 1
    THANK-YOU! I was beginning to think this would never stop. lol.
    – Sparky
    Commented Feb 28, 2013 at 20:27
  • Awesomeness in its best! Wonder how come we didn't see LOT more reports of this sort then? As for bounty I could have given this to you, it served its purpose after all (by luring you here :)) and you deserve it rightfully. ;)
    – Shadow Wizard
    Commented Feb 28, 2013 at 20:44
  • @ShaWizDowArd the cookie is rotated after a set amount of time and most of your requests were to the "normally authenticated" pages, so it wouldn't (thankfully) occur that much.
    – Jarrod Dixon
    Commented Feb 28, 2013 at 20:50
  • This sounds right. I am monitoring the RSS feed of questions on a couple of topics, and the logout frequency is about right for the RSS poll frequency.
    – ravenspoint
    Commented Feb 28, 2013 at 22:29
  • Yes! I reduced the frequency of RSS refreshing, and I can stay logged in for a sensible length of time. +1 vote
    – ravenspoint
    Commented Feb 28, 2013 at 23:09
  • @ShaWizDowArd, probably because 95+% of the users don't keep a window open or stay here very long. Then of the remaining users, most people won't take the time to complain. Thankfully, your 500 rep bounty got the needed attention and I'm wondering how this would have played out otherwise... a few days ago, my OP was 2 votes away from being closed as "too localized". lol.
    – Sparky
    Commented Mar 1, 2013 at 18:35
  • Cheers @Sparky glad my rep is being used for a good cause! :-)
    – Shadow Wizard
    Commented Mar 1, 2013 at 18:59
  • Jarrod, in the future, what do you recommend one should do when a bug like this is found and the meta OP goes ignored for several weeks? Thanks.
    – Sparky
    Commented Mar 1, 2013 at 19:04
  • @Sparky I would suggest trying to add more debugging info - it wasn't the bounty that Sha Wiz Dow Ard added that got my attention, it was the excellent video in his answer that showed there was an issue.
    – Jarrod Dixon
    Commented Mar 1, 2013 at 19:06
  • In this case, I provided every detail that I could think of... it just seemed very random and frequent.
    – Sparky
    Commented Mar 1, 2013 at 19:08
  • @Sparky you did all you could, as it was a very insidious bug; it really didn't help that we were moving data centers (which clouds lots of bug reports). Sorry it took me so long to notice the issue!
    – Jarrod Dixon
    Commented Mar 1, 2013 at 19:11
  • I'm glad it got fixed... I was mostly just concerned that I followed standard procedure in reporting it. Thanks again.
    – Sparky
    Commented Mar 1, 2013 at 19:16
  • Just (very) curious: what do you use to revalidate the cookie then, in a way that this won't work in the browser of a cookie thief? Are you using se:fkey from Local Storage to sign a renewal request? And does this imply that Why doesn't the Stack Overflow team fix the Firesheep style cookie theft? is status-completed-as-far-as-we'll-be-fixing-it?
    – Arjan
    Commented Mar 1, 2013 at 19:20
  • 1
    @Arjan we use a variant of this series/token cycling technique - when we get an invalid pair, we destroy the session, so a theft could only last for a few minutes (provided the account owner is still browsing). Our sysadmins are working on HTTPS now; I'm not sure the time frame, though.
    – Jarrod Dixon
    Commented Mar 1, 2013 at 19:34
3

Learning about today's (2/9/13) planned outage explained a lot. The constant logout problems I experienced yesterday had a timeline similar to the activities described here:

https://stackstatus.tumblr.com/post/42602026025/succeeding-back-to-new-york-feb-9-2013

Improve this answer
3

OK, I have this exact same thing going on for about the same time.

First of all, live demonstration:

http://www.youtube.com/watch?v=LXLLuDTBQsg

Now for my insights.

  1. It happens only on this very Meta site.
  2. It happens only if I leave the browser inactive for about 10-15 minutes in the site home page, if I'm inside a question it's not happening.
  3. The real time updates (i.e. web socket connection) still works during this whole time, I see inbox items pop and "x new items with new activity" ever increasing.
  4. Trying to access the inbox results in error as expected.
  5. Refreshing the home page isn't logging me in automatically, just going to the login page itself.
  6. I have tried using Facebook OpenID instead of Google. No change.
Improve this answer
3
  • I can verify every single step except item #1... it's happening to me on SO as well as Meta. And I never leave my browser open to Meta, so it only happens there on every new visit. Items 2, 3, 4, 5, & 6... yes, yes, yes, yes and yes!
    – Sparky
    Commented Feb 28, 2013 at 15:34
  • Weird, what tab you browse on Stack Overflow? Tag specific page perhaps?
    – Shadow Wizard
    Commented Feb 28, 2013 at 15:35
  • Most of the time on SO, I just click the SO icon and browse whatever questions are there. Although one time, I got an error trying to post a comment on a question because I had been logged out.
    – Sparky
    Commented Feb 28, 2013 at 15:36
1

I think Google may have been doing some maintenance today. I got booted from Google Apps several times today. Hope they fixed whatever it is they where trying to fix.

Improve this answer
4
  • Whatever it is, it happened twice more since your response.
    – Sparky
    Commented Feb 9, 2013 at 3:00
  • 1
    Google doing maintenance wouldn't cause anybody to get logged out of Stack Overflow.
    – balpha StaffMod
    Commented Feb 9, 2013 at 8:41
  • 2
    It's been happening to me, and I don't use Google for my open ID.
    – Andrew Grimm
    Commented Feb 10, 2013 at 10:16
  • 1
    @balpha since yesterday I keep getting kicked out every hour and have to log in again. It happens only here on Meta. anything on your side might cause it?
    – Shadow Wizard
    Commented Feb 11, 2013 at 7:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .