search

WordPress / gutenberg

The Block Editor project for WordPress and beyond. Plugin is available from the official repository.
https://wordpress.org/gutenberg/
Other
10.56k stars 4.22k forks source link

Infinitive loop on API req in Block editor after wordpress_logged_in cookie is removed #67431

Open iruzevic opened 4 hours ago

iruzevic commented 4 hours ago

Description

When you log into the editor and manually remove the wordpress_logged_in cookie, any attempt to save or perform actions in the editor will trigger an infinite loop of API requests, resulting in a 403 Forbidden response with rest_cookie_invalid_nonce.

Even after refreshing the page, these requests will persist, and the only way to stop them is to manually log out.

This infinite loop of requests can spike your CPU to 100%, rendering your site unresponsive.

All details can be found here on the video: https://drive.google.com/file/d/1SpwEp_kg0okedNBe9yfHpAqMb-wQKdPi/view?usp=sharing

Step-by-step reproduction instructions

  1. Login
  2. Open an block-editor
  3. Remove the wordpress_logged_in cookie
  4. Save the draft
  5. See the infinitive requests in the inspector

Screenshots, screen recording, code snippet

https://github.com/user-attachments/assets/c1361c9e-810f-46a1-b1ce-bf6bae1329b6

Environment info

Tested:

Please confirm that you have searched existing issues in the repo.

Please confirm that you have tested with all plugins deactivated except Gutenberg.

Please confirm which theme type you used for testing.

Mayank-Tripathi32 commented 3 hours ago

Hello @iruzevic,

Thank you for reporting the issue. I was able to replicate the problem. While saving settings and other actions worked in settings page but I couldn’t save Gutenberg drafts. I’m not entirely sure how this should be addressed—perhaps the system should log the user out if the cookie is removed or missing?

Test Bench: