Server side bug with lemmy.world and intermitent authentication.
I am currently getting signed out every minute from lemmy.world. This is not a client side cache issue. I tested making API calls from the command line (with curl) with no cache and the issue still occurs. One call I get the correct response, the next I get a 400 telling me im not signed in.
Sounds like lemmy.world runs on 2 instances and the requests are being loadbalanced between those two. That and that the jwt secret is different between those two instances causing one to accept and the other to reject
This is also my theory. I think youโre right on the money here. They probably rotated secrets from yesterdayโs hack and forgot to restart both servers.
From my tests, it's almost perfectly a 50/50 whether any API requests you make will yield a 200 (success) or a 400 (not signed in). If you perform an action that takes 3 API requests, your chances of succeeding is (1/2)^3 or 1/8 because only 1 request needs to fail in the chain for the entire action to fail. So, as long as you make single API actions you can maximize your success rate :D
Seems like spamming actions also gets it to work eventually. It's a pain in the arse though lol. I made some alt accounts on other instances, but I'm lazy and don't wanna rebuild my subscription feed if I don't have to, so hopefully it gets fixed at some point.
Same issue here, I'm being automatically logged out of my lemmy.world account in Firefox. If I refresh the page even immediately after logging in, I'm automatically logged out.
Yeah. Lemmy.world is currently unusable on the desktop. I don't have that problem in Memmy. Growing pains but I hope the problem will be fixed soon. Do anyone know if one of the mods in North America are aware of the problem?
I was having trouble in liftoff and the browser. Cleared data and cache from liftoff thinking maybe something got messed up there and now I can't even log back into my .world account ๐คทโโ๏ธ I'll hang here for a bit I guess.
I'm choking in desktop browser and in liftoff. Jerboa seems ok. It's weird to me how different clients react differently, I'm not sure how they interact differently.
Login in likely always succeeding. The issue is that whatever app/website you use will make additional API calls afterwards (eg. fetch posts or fetch unread count). Each of those calls have a 1-in-2 chance to succeed and if any of them fail, they all fail and you will be booted out.
Lemmy is now an RNG game. We must prayge to rngesus before making any actions.
FWIW, I can confirm I'm having this issue as well. The load balancing hypothesis seems sound given the behavior I'm seeing. Definitely making lemmy.world pretty much unusable at this point.
Ahhh thanks for that! I took could not stay logged in, annoyingly id find out when I attempted a post/reply, "not logged in". Using Connect or website.
I installed jerboa, logged in ok and here I am. If it goes bad too then I dunno...
I've been experiencing something similar/related. If I am logged in and open something in a new browser window, it frequently (starting today) shows me as not logged in. If I refresh the page, I'm suddenly logged in. This doesn't feel like a authentication problem as much as a timing issue while loading the page. Or maybe what I'm seeing is an entirely different issue.
I can't seem to comment on a couple specific posts on the instance. But as you can see, it works on this one. I am wondering if that's related? I'm not even on my Lemmy.World account and get an unable to post error as soon as I hit the button, like it's not even trying to do anything.
Making a new post is a nightmare. I wish the submit button would time out in these instances so you can try again. Right now I'm having to copy and paste into a new tab and hope for the best (but fail, 5 times and counting).
At least when you can't log in on one instance you can just login on another. Downtime doesn't mean you have to go do something else anymore!
I'm seeing the same issues on my app, calling login, then immediately using that jwt to fetch the site details and it doesn't give my_user half of the time, and if my app loads far enough to check the unread count I get not_logged_in
The issue is server sided so it will not matter what you use unfortunately. Technically a temp but terrible fix is to keep retrying on 400s (not signed in) until a 200 (success) is returned. This is terrible because you pretty much never want to retry for 400 errors because 400 errors are client side errors (except in this case).
Lemmy.Fmhy.ml is a sweet spot. It's in the top 10, but further down the list. Active and ran by cool admins. No issues from massive user counts (so far). The community is pretty strong and active so i imagine it's got some staying power.
Ah damn. Was wondering what was happening. My lemmy.world account is unusable atm due to the bug. I'm gonna have to figure out what all of my subs were.
I made LASIM - it's takes 2 API calls to fetch your subscriptions (1 login, 1 profile), so with lemmy.world being 50/50 on those calls, you might have to try a few time, but once you have em, it will be easy to push them to a new instance.
I noticed it a little yesterday, but strangely it seems worse today. I'd cleared cache & cookies after the compromise issue, so I was pretty sure it wasn't to do with not doing that, however I think OP's on the right track with their assessment.
Not really sure why it would suddenly seem worse though, other than maybe something to do with server traffic/activity.