Bug Report: Call to get_session_questions fails with 403 Unauthorized,

1

:bug: Bug description:
Call to get_session_questions fails with 403 Unauthorized, with response

{
    "error": "Unauthorized",
    "detail": "No token provided. Not authenticated.\\n"
}

In the Screenshot you can see a successful (left) vs unsuccessful (right) call.

prodigy_bug_screenshot
prodigy_bug_screenshot1903×898 191 KB

:man_walking:t4:Reproduction steps:
How can we recreate the bug?
That is the problem: I don't know how to recreate it. It just happens from time to time.

In the unsuccessful call, the Access-Control-Allow-Origin is set to *, which apparently causes the browser to not include the prodigy cookies. I.e. the error message is correct: the browser wasn't sending cookies, so prodigy wasn't able to check the token.

ChatGPT suggests that this might be caused by caching. The web server is sending a cached version, causing the difference in Headers.

:desktop_computer: Environment variables:
prodigy stats:

15:01:01: RECIPE: Calling recipe 'stats'

============================== ✨  Prodigy Stats ==============================

Version          1.18.2                        
License Type     Prodigy Company               
Location         /usr/local/lib/python3.11/site-packages/prodigy
Prodigy Home     /home/prodigy/.prodigy        
Platform         Linux-6.6.104.2-4.azl3-x86_64-with-glibc2.41
Python Version   3.11.13                       
spaCy Version    3.8.7                         
Database Name    PostgreSQL                    
Database Id      postgresql                    
Total Datasets   1                             
Total Sessions   20

If you have any suggestion on how to pinpoint the problem, I would be very grateful.

2

Welcome to the forum @lkp! :waving_hand:

Thanks for a detailed report!
The error message you see comes from Prodigy checking for the identity token in request's cookies.
This code is deterministic - it simply checks if cookies are present in the incoming request. There's no randomness or race condition here (which could explain intermittent behavior).
Your analysis of the headers is correct: it tells us that sometimes Prodigy can receive a cookie-less request.
The question is where such cookie-less request come from. Cache is definitely a plausible source.

Is there any infrastructure that sits between the browser(s) and Prodigy that could have such cache layer e.g nginx or similar?