hiding of messages and notifications (via cookie) doesn't seem to persist
Summary
A customer reported that broadcast messages etc. were not persistently dismissed; if they log out, and log back in again, the messages reappear.
I found !30432 (merged) which implemented this, suggesting that messages should be dismissable, and persisted via a cookie.
Details of a cookie in my browser generated by my test instance:
hide_broadcast_message_3:"true"
Created:"Wed, 17 Jan 2024 19:03:49 GMT"
Domain: xx
Expires / Max-Age:"Thu, 18 Jan 2024 15:48:25 GMT"
HostOnly:true
HttpOnly:false
Last Accessed:"Wed, 17 Jan 2024 19:03:49 GMT"
Path:"/"
SameSite:"None"
Secure:true
Size:28
When I log out, and log back in, it's not present.
Steps to reproduce
- Set up a notification or dismissable broadcast on the instance.
- Log in as a user, dismiss it.
- Log out, log back in again as that user. Message reappears.
Example Project
What is the current bug behavior?
Dismissed messages do not persist.
What is the expected correct behavior?
TBC: dismissed messages persist via a cookie
Relevant logs and/or screenshots
Output of checks
I've reproduced this on 14.10 and 16.6.
I'm wondering if this isn't a change in behaviour of GitLab, but potentially of browsers. I'm testing with Firefox 121.0.1
Possible fixes
See analysis in #438595 (comment 1799977433)
- Add database tracking of dismissals to broadcast messages
- Add a join table between users and broadcast messages that populates if a user dismisses the broadcast message
- Ensure performance considerations are maintained when implementing.
- Replace current cookie setting and observation with this.
- Determine if there is some way we can consider backfilling the join data table with current dismissals or perhaps keep both being observed for a certain period of time.