A Real-Browser-Only Login Bug, DMX Automation at Church, and Bridging the Gap

The GitLab login bug that only ever broke for real browsers

GitLab, running behind rust-proxy, had a login failure that made no sense: it failed every single time in real Chrome and Edge, desktop and mobile, and worked perfectly every time from a scripted test using the exact same login. That split is usually the clue that something's happening that only a real browser does. So instead of guessing, I drove an actual browser through the problem with an automated testing tool and watched it fail the same way.

I ruled out a long list of reasonable suspects — browser cache, extensions, different networks and devices, special characters in the password, timing — before the real cause showed up in a raw capture of the network traffic. I temporarily rerouted the connection so I could see the exact data going by, then put everything back the way it was. Sitting right there: the login cookie had been split into four separate pieces instead of one. That's something real Chrome and Firefox are allowed to do and actually do; the scripted tests don't, which is exactly why they never reproduced it. GitLab's own server only reads the first piece off the wire, and the actual login session was sitting in the second one. GitLab never saw a real session at all, so it rejected the login. I fixed rust-proxy to put those split pieces back together into one before handing them to GitLab, and confirmed the fix really worked by watching that same automated browser sail through login, then confirmed it for real logging in with a security key in one browser and two-factor in another.

That same traffic-capture trick paid off twice more, closing a couple of other real gaps in how rust-proxy talks to the servers behind it: one kind of request was being forwarded in a form that happened to work by accident against most servers but got correctly rejected by a stricter one, so I fixed the format before forwarding it. The visitor's real IP address is now passed along to every server behind the proxy, instead of every one of them seeing the proxy's own address as if it made every request itself. And there's now a setting that lets an operator relax an overly strict cookie setting on a site that needs it, for cases where modern browsers would otherwise quietly throw the cookie away. All four fixes are tested and pushed.

Bridging the Gap

After the workday wrapped up, took Lisa to her work's Bridging the Gap dinner — a nice way to close out a day that started with rewiring the church's AV and lighting integrations and ended with good food and good company.