Uploaded image for project: 'MusicBrainz Server'
  1. MusicBrainz Server
  2. MBS-11238

Beta: Site ignores whether the user is already logged in for external referrers

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Normal Normal
    • Beta
    • None
    • Accounts
    • None

      Unfortunately the new SameSite=Strict policy that was introduced in https://github.com/metabrainz/musicbrainz-server/pull/1776 now causes a new problem: In case you have set the beta preference, every link to mb.org is first redirected to beta before it then shows the page from the POV of a logged out user. This happens e.g. when you visit entity pages from search engine results but also for direct links to specific edits from posts at https://community.metabrainz.org. As JIRA is also an external referrer for MB you can verify this behaviour by clicking the example links to beta.mb.org (no need to set the beta preference) in the next paragraph.

      For entity pages you can simply click on the entity header which links to the current page (but now from an internal referrer) as a workaround, but e.g. the page for a specific edit does not allow that. So you have to click one of the login links/buttons which leads to another annoying problem:

      After clicking a Login button, the site redirects to the users profile page and not the previous page as the query parameter uri suggests. This might be related to the fact that there is no real need to perform a login, i.e. the Login button does not take you to the login form as usual (which does the correct redirect by the way). Feel free to open an additional ticket if this is a separate issue.

            bitmap Michael Wiencek
            kellnerd David Kellner
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved:

                Version Package
                Beta