3 ms·
tl;dr: A Rails upgrade last January caused previously valid code to reset the session (but only once per user per session). The session reset caused a logged-i
by blahedo 15y ago
tl;dr: A Rails upgrade last January caused previously valid code to reset the session (but only once per user per session). The session reset caused a logged-in user to be suddenly logged out; but most users' use-flow (and Patrick's test-flow) made the session reset happen before login, so the bug only manifested visibly about 1% of the time. Moral: race conditions are hard! (Alternate moral: read the release notes carefully before upgrading.)
- laughinghan 15y agoTechnically, the reason it was once per use per session was not because of the Rails upgrade, but because once the A/Bingo human check missing the CSRF token resets the session, the visitor is marked human and not checked again.
- lambda 15y agoAnother alternate moral: Something that seems like a very minor patch-level change which just fixes a bug and doesn't affect your API actually can break running production code. Many people like to pretend that they can follow a discipline like Semantic Versioning (http://semver.org/ http://semver.org/). But minor changes like this can cause subtle bugs when you are upgrading between patch-level versions of a component that you're working with.