Summary
A user who was previously logged in, and takes no action (does not log themselves out or anything like that), opens mattermost in a browser or desktop client and sees an infinite refresh loop. They may be able to access mattermost via a different client, but on the affected client they have no way to proceed.
Steps to reproduce
Observed over many mattermost versions; most recent occurrence on 4.3.2. Observed with Chrome and desktop clients on multiple OS. We delegate auth to gitlab. Other than that, no known way to reproduce.
I am guessing that it is triggered by the affected session reaching its timeout, so the session becomes logged out as expected. However I haven’t confirmed that.
Expected behavior
No infinite refresh loop
Observed behavior
While stuck in the refresh loop, we can see the purple button for gitlab login appear on each render. Sometimes if the user clicks at the exact right moment they can reach the login screen and this resolves the issue.
We previously found that clearing all cache data in the browser/client also fixes it.
During the refresh loop, the log continuously fills with these messages:
[2017/11/16 11:43:44 AEDT] [EROR] /api/v4/users/me: code=401 rid=zoj1btgtspb7fgrjersbgbjwto uid= ip=10.70.34.172 Invalid or expired session, please login again. [details: UserReq
uired]
[2017/11/16 11:43:44 AEDT] [EROR] /api/v4/users/me/preferences: code=401 rid=xe1rx9gpotdp5qg3zm5xep54co uid= ip=10.70.34.172 Invalid or expired session, please login again. [deta
ils: UserRequired]
[2017/11/16 11:43:44 AEDT] [EROR] /api/v4/users/me/teams: code=401 rid=qor8umozofy45xzbnjym78z61c uid= ip=10.70.34.172 Invalid or expired session, please login again. [details: U
serRequired]
[2017/11/16 11:43:44 AEDT] [EROR] /api/v4/users/me/teams/members: code=401 rid=p8m4zwy71prypq4kceohxjtdsy uid= ip=10.70.34.172 Invalid or expired session, please login again. [de
tails: UserRequired]
[2017/11/16 11:43:44 AEDT] [EROR] /api/v4/users/me/teams/unread: code=401 rid=8i9ynzj4n7bc7nujrtic4kgqea uid= ip=10.70.34.172 Invalid or expired session, please login again. [det
ails: UserRequired]
[2017/11/16 11:43:44 AEDT] [EROR] /api/v4/emoji: code=401 rid=zhkph9gaufrbxpcnc8zs13dc9r uid= ip=10.70.34.172 Invalid or expired session, please login again. [details: UserRequir
ed]
Note: this issue was previously raised in [SOLVED] Infinite refresh loop in browser clients, with "Invalid or expired session" log error spam. I am raising a new topic because
- the former one has been marked solved
- I think the previous topic addressed some related but different behaviour for other users; I’d like to get back to the specific behaviour affecting my users