Unable to log out of my account

[KathleenLabrie]

Describe the bug
I created a new account. That went well. Now I want to log out. Apparently I can't. All I see is a "Log In" button and "Register" button. No "Log out" button anywhere. If I click on "Log In", I'm just taken back to my already logged in account.

Expected behavior
I want to log out of the account. (eg maybe to log into a different account) I would expect a "Log out" button somewhere.

To Reproduce
The page I'm on is "https://pypi.org/manage/projects/" It is clearly linked to my account. I have no idea if I'm the only one affected by this or if I'm missing something considered obvious by others.

My Platform
Mac OS Sonoma (Intel chip). Chrome 136.0.7103.114

Additional context

[ewdurbin]

Hi Kathleen, I believe this is an issue with the fact that our user_id__insecure cookie is set to expire on Session, while the actual cookie that makes one "logged in", session_id, just has an expiration date.

Your situation is reproducible in browsers that respect the Session expiration by quitting the browser after logging in, and coming back to pypi.org.

It seems the right solution here is to set the user_id__insecure and session_id to the same Expiration value, and I think my preference is for that to be Session.

[ewdurbin]

In the meantime you can work-around by navigating to https://pypi.org/account/logout/ directly.

[KathleenLabrie]

Thanks for the link!!! That worked.

[miketheman]

Looks like the issue is in browser configuration for these behaviors is slightly mismatched across browser types.

Further testing shows that both Chrome (137.0.7151.69) and Firefox (139.0.4) will not remove Session cookies on browser closure (not tab!) with the setting "Continue where you left off" enabled. (Firefox setting is named "Open previous windows and tabs")

Safari 18.5 also has a setting "Safari opens with All windows from last session" but respects the removal of Session cookies.

A deeper read on the topic: https://textslashplain.com/2019/06/24/surprise-undead-session-cookies/

The impact is that on page-load, the client-side javascript is looking for a cookie that it's allowed to interact with (a non-HttpOnly cookie) to determine what to show the user, and since only some browser behaviors expire the user_id__insecure cookie, the user experience is hampered when the user still has a valid session_id cookie, which can control the server-side rendered pages, like whether a user's manage project page loads or redirects to an login page when not logged in, leading to a mixed experience.

Instead of using Session expiry, using the same max_age expiry will make the behavior of both cookies conform to the same behavior, and not rely on browser configuration behavior, giving the end user a consistent experience.

[ewdurbin]

I would personally lean towards making both Session expiry. As a safari user, I kind of like the ability to know my PyPI login is destroyed on a Cmd+Q

[miketheman]

The problem with making them Session expiry in conjunction with Chrome/Firefox behaviors means that session can effectively never expire, which is counter to PyPI current behaviors vis a vis session expiry.

Safari currently clocks in at under 10% of all client sessions (as reported by Plausible for the past 12 months), vs Chrome and Firefox which exceed 70% (I don't have a Microsoft Edge system to test - that accounts for another 15% of browsers).
While I'd prefer all browsers to behave like Safari does, the reality is they don't, and we should decide how to behave under the conditions that lead to this mismatch and rely less on end-user configurations.

One complex option would be to move everything to server-side rendering and remove the need to share any cookies for behavioral purposes to JavaScript, but that has negative implications on the way pages are built and cached, so this doesn't sound great to me.

Do you have any other ideas on solving without setting a max_age on user_id__insecure?

[ewdurbin]

Because our sessions are validated based on their existence in redis, there's no need to worry about how long the cookie lives in the browser. Once a user's session has been idle for 12 hours, the redis key will disappear and it will no longer validate and they will be logged out.

#18269 moves us to using Session expiration, which will allow the "best of both worlds". The actual session and the insecure user id cookies will behave the same and users who opt into the behavior for session cookies to survive browser/tab quits will retain their session for the same period of time as before.