Updates:
Owner: [email protected]
Comment #35 on issue 25755 by [email protected]: Gmail automatically
logging out Chrome users
http://code.google.com/p/chromium/issues/detail?id=25755
The problem is in the new byte range support in our http cache.
Re-assigning to Ricardo for a fix --> we shouldn't clobber extra_headers
from PartialData::PrepareCacheValidation.
-----------------------------
Here is explanation of what is happening:
----------------------------
When you initially load gmail, it caches a bunch of static files.
In particular, this large javascript is of interest:
http://mail.google.com/mail/?
ui=2&view=jsm&name=sy55%2Csy58%2Csy62%2Csy26%2Csy60%2Csy61%2Csy56%2Csy59%2Csy66%2Ccm&ver=nxuHLIqdUtA.en.&am=!CJUZrzRQt-
K5Bd7y0PcKTspR30sF9IhD0p8OxhGI5H7z
Now, the next time you sign into gmail.com, if the stars and planets align
just right (or enough time has passed), then this
file will need to be revalidated.
So in the cache layer, we will decide the cached response needs to be
validated before it can be used, and manufacture a
conditionalized request.
So far so good.
Next, we go through the new byterange code -- strictly speaking this isn't
a byterange request, but since the code
generalizes regular stuff in terms of ranges too, so we end up with a
PartialData just the same.
Now the problem is, PartialData::PrepareCacheValidation() overwrites the
extra request headers of the custom conditionalized
request, in order to stick in a "Range: " header (which in this case will
simply span the entire file).
This is bad, as it clobbers the original user cookies that were attached to
the request.
So we end up sending an If-Modified-Since over to the mothership without
the right cookies.
Consequently gmail responds back with a 401 [*].
Lastly, we pass the 401 down to the render, which sets off a chain of
events (details don't matter) ending with you signed
out of gmail.
If we had instead sent the proper validation request to gmail, we would
have ended up passing down a 200 to the render, and
life would have been good.
[*] As an aside, the handling of 401 in the case of validation request
looks a bit dodgy; but it doesn't affect this issue.
> I was using only one GMail account
@jopemoro: Thanks for that data. Indeed, contrary to my early idea, you
don't need to have signed in from multiple accounts
to hit this; it is sufficient to have simply used gmail, as described above.
--
You received this message because you are listed in the owner
or CC fields of this issue, or because you starred this issue.
You may adjust your issue notification preferences at:
http://code.google.com/hosting/settings
--~--~---------~--~----~------------~-------~--~----~
Automated mail from issue updates at http://crbug.com/
Subscription options: http://groups.google.com/group/chromium-bugs
-~----------~----~----~----~------~----~------~--~---
