Login fails with "For security, this session has been signed out"

[richvdh]

Steps to reproduce

1. Start with an active session on an account on matrix.org
2. Opt in to analytics
3. Invalidate that session somehow from outside the client (eg by logging out from another device)
4. Attempt to log into an account on another homeserver
5. wait

Outcome

What did you expect?

Client is successfully logged in to new account

What happened instead?

Operating system

Ubuntu 22.04

Browser information

Firefox 111.0

URL for webapp

https://develop.element.io

Application version

No response

Homeserver

sw1v.org

Will you send logs?

No

[t3chguy]

Related #13005 #15619

[richvdh]

This seems to be a problem in the PosthogAnalytics code. PosthogAnalytics.updateAnonymityFromSettings is being called with the old MatrixClient, which obviously presents an invalid access token.

It's rather troubling from the security point of view that we're hanging onto an old MatrixClient with the corresponding account details despite telling the user that we've been logged out.

[weeman1337]

Unfortunately, I cannot reproduce this. I've signed in using app.element.io and development.element.io . Then I've signed out my development session from app. At this point I saw the dialog from the description „Signed Out…“. I was then able to switch the homeserver and log in with a different account. Didn't see the dialog again.

@richvdh can you validate the steps to reproduce and possibly update them?

[richvdh]

One thing that might be necessary is opting into pseudonymous analytics. I have this in my account data:

{
  "type": "im.vector.analytics",
  "content": {
    "id": "c7b1e66e-9b3d-41e6-88ca-d6f3ca6e5fe2",
    "pseudonymousAnalyticsOptIn": true
  }
}

What I notice is that, after being logged out in this way, SettingsStore still has registered watchers for pseudonymousAnalyticsOptIn:

Array.from(mxSettingsStore.watchers.entries()).filter(([k,v])=>k.search("pseudonymousAnalyticsOptIn")>=0)

->

0: Array [ "1688467641100_15_pseudonymousAnalyticsOptIn_null", localizedCallback(changedInRoomId, atLevel, newValAtLevel)]
​1: Array [ "1688467646504_18_pseudonymousAnalyticsOptIn_null", localizedCallback(changedInRoomId, atLevel, newValAtLevel)]
​2: Array [ "1688468704319_692_pseudonymousAnalyticsOptIn_null", localizedCallback(changedInRoomId, atLevel, newValAtLevel)]
​3: Array [ "1688468705035_695_pseudonymousAnalyticsOptIn_null", localizedCallback(changedInRoomId, atLevel, newValAtLevel)]

and of course those listeners still have the old MatrixClient in their closure.

[weeman1337]

Can reproduce. Added the analytics opt in to the description.

[weeman1337]

Marked this as S-Minor because it can be worked around with reload.
O-Occasional because you need to opt in to analytics and switch accounts with the same browser window.

[richvdh]

I don't think it's necessary to switch accounts, actually. All you need is to be opted into analytics (not that uncommon, hopefully?) and to try to log in after being logged out.