TPA login while session cookie missing but valid JWTs present causes safe-session mismatches

We’ve seen a number of mysterious safe-sessions mismatches that appear to occur in close conjunction with an SSO login. We were able to reproduce this by deleting just the session cookie and then logging into a different account.

We’ve also seen some nginx logs that suggest that every once in a while someone loses a session cookie for no apparent reason; this may just be browser gremlins.

Reproduction

• Delete all edx.org cookies
• Visit https://courses.edx.org/dashboard and log into first account (with username and password, but maybe doesn't matter)
• Delete session cookie and visit https://courses.edx.org/dashboard again (redirected to login page)
• Log in to second account with Google
• Dashboard shows second account in selector
• Choose Account from dropdown
• When https://account.edx.org/  loads it shows first account for user menu

The mismatch occurs when an MFE is loaded; the MFE sends both JWT and session cookie to the LMS; the LMS first loads the user from the session and then the DRF middleware replaces the user with the one listed in the JWT.

Hypotheses

Somewhere in the TPA login flow, we think something is detecting valid JWT cookies (and not noticing that they’re for the wrong user) and therefore chooses not to “refresh” them (set new ones). Note that with missing or garbage JWT cookies, this bug does not happen – TPA login instead creates new (matching) JWT cookies.

Note: This ticket was moved from this original 2U private-link ticket.

Start with the TPA login flow and the DRF middleware described in the issue, then reproduce the sequence by deleting the session cookie while retaining valid JWT cookies. Trace which account each authentication source selects and verify that the MFE and account.edx.org consistently show the account used for the second login.