Affected Version

Tested on 4.0.3

phpunit/phpunit            5.7.27             The PHP Unit Testing framework.
silverstripe-themes/simple dev-master c2fdd14 The SilverStripe simple theme (default SilverStripe 3 theme)
silverstripe/recipe-cms    1.0.3              SilverStripe recipe for fully featured page and asset content editing
silverstripe/recipe-plugin 1.1.0              Helper plugin to install SilverStripe recipes
silverstripe/tagfield      2.0.0              Tag field for Silverstripe

But potentially affects all previous versions.

Description

One Plus devices (current and old) send different User Agent strings for GET and POST requests which causes session validation to fail because of,

vendor\silverstripe\framework\src\Control\Session.php

/**
     * Init this session instance before usage
     *
     * @param HTTPRequest $request
     */
    public function init(HTTPRequest $request)
    {
        if (!$this->isStarted()) {
            $this->start($request);
        }

        // Funny business detected!
        if (isset($this->data['HTTP_USER_AGENT'])) {
            if ($this->data['HTTP_USER_AGENT'] !== $this->userAgent($request)) {
                $this->clearAll();
                $this->destroy();
                $this->start($request);
            }
        }
    }

It’s a documented bug found in their forum, but a resolution probably isn’t close, https://forums.oneplus.com/threads/chrome-user-agent-is-different-when-making-an-post-request.691815/ https://forums.oneplus.com/threads/inconsistent-user-agent-string-chrome-for-android-ajax-requests.796666/

Steps to Reproduce

• Logging into the CMS with a One Plus device and moving between pages.
• Additionally, adding a logging event to the Sessions.php file for monitoring the UA string between requests.

Debug Data

Here are the strings between requests for One Plus 5 and One Plus 3T, respectively,

GET: Mozilla/5.0 (Linux; Android 8.1.0; ONEPLUS A5000 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.158 Mobile Safari/537.36
POST: Mozilla/5.0 (Linux; Android 8.1.0; Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.158 Mobile Safari/537.36

GET: Mozilla/5.0 (Linux; Android 8.0.0; ONEPLUS A3003 Build/OPR6.170623.013) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.137 Mobile Safari/537.36
POST: Mozilla/5.0 (Linux; Android 8.0.0; Build/OPR6.170623.013) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.137 Mobile Safari/537.36

Proposed Fix

We resolved this for our e-commerce systems by creating a configuration flag that allows disabling UA validation for session management. Another potential fix would be to drop UA validation completely? They’re inconsistent and borky.

Pull requests

• https://github.com/silverstripe/silverstripe-framework/pull/9170