Signing out of self-hosted Gitlab EE also signs out of self-hosted standalone Mattermost servers when in Chrome tabs

Results of GitLab environment info

Expand for output related to GitLab environment info

dmatz@gitlab:~$ sudo gitlab-rake gitlab:env:info

System information
System:         Ubuntu 20.04
Proxy:          no
Current User:   git
Using RVM:      no
Ruby Version:   3.1.5p253
Gem Version:    3.5.11
Bundler Version:2.5.11
Rake Version:   13.0.6
Redis Version:  7.0.15
Sidekiq Version:7.1.6
Go Version:     unknown

GitLab information
Version:        17.1.2-ee
Revision:       91c6434080c
Directory:      /opt/gitlab/embedded/service/gitlab-rails
DB Adapter:     PostgreSQL
DB Version:     14.11
URL:            https://gitlab.asf.alaska.edu
HTTP Clone URL: https://gitlab.asf.alaska.edu/some-group/some-project.git
SSH Clone URL:  git@gitlab.asf.alaska.edu:some-group/some-project.git
Elasticsearch:  no
Geo:            no
Using LDAP:     yes
Using Omniauth: no

GitLab Shell
Version:        14.36.0
Repository storages:
- default:      unix:/var/opt/gitlab/gitaly/gitaly.socket
GitLab Shell path:              /opt/gitlab/embedded/service/gitlab-shell

Gitaly
- default Address:      unix:/var/opt/gitlab/gitaly/gitaly.socket
- default Version:      17.1.2
- default Git Version:  2.45.1

Results of GitLab application Check

Expand for output related to the GitLab application check

dmatz@gitlab:~$ sudo gitlab-rake gitlab:check SANITIZE=true
Checking GitLab subtasks ...
Checking GitLab Shell ...
GitLab Shell: ... GitLab Shell version >= 14.36.0 ? ... OK (14.36.0)
Running /opt/gitlab/embedded/service/gitlab-shell/bin/check
Internal API available: OK
Redis available via internal API: OK
gitlab-shell self-check successful
Checking GitLab Shell ... Finished
Checking Gitaly ...
Gitaly: ... default ... OK
Checking Gitaly ... Finished
Checking Sidekiq ...
Sidekiq: ... Running? ... yes
Number of Sidekiq processes (cluster/worker) ... 1/1
Checking Sidekiq ... Finished
Checking Incoming Email ...
Incoming Email: ... Reply by email is disabled in config/gitlab.yml
Checking Incoming Email ... Finished
Checking LDAP ...
LDAP: ... Server: ldapmain
not verifying SSL hostname of LDAPS server 'ldap.asf.alaska.edu:636'
LDAP authentication... Success
LDAP users with access to your GitLab server (only showing the first 100 results)
User output sanitized. Found 100 users of 100 limit.
Checking LDAP ... Finished
Checking GitLab App ...
Database config exists? ... yes
Tables are truncated? ... skipped
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config up to date? ... yes
Cable config exists? ... yes
Resque config exists? ... yes
Log directory writable? ... yes
Tmp directory writable? ... yes
Uploads directory exists? ... yes
Uploads directory has correct permissions? ... yes
Uploads directory tmp has correct permissions? ... yes
Systemd unit files or init script exist? ... skipped (omnibus-gitlab has neither init script nor systemd units)
Systemd unit files or init script up-to-date? ... skipped (omnibus-gitlab has neither init script nor systemd units)
Projects have namespace: ...
2/1 ... yes
4/3 ... yes
3/5 ... yes
4/7 ... yes
3/8 ... yes
3/9 ... yes
3/10 ... yes
9/11 ... yes
3/12 ... yes
3/13 ... yes
3/14 ... yes
9/15 ... yes
3/16 ... yes
9/17 ... yes
9/18 ... yes
9/19 ... yes
3/20 ... yes
9/21 ... yes
117/22 ... yes
9/23 ... yes
3/24 ... yes
3/25 ... yes
3/26 ... yes
3/27 ... yes
3/28 ... yes
3/29 ... yes
3/30 ... yes
3/31 ... yes
3/32 ... yes
3/33 ... yes
58/34 ... yes
58/35 ... yes
58/36 ... yes
9/37 ... yes
9/38 ... yes
3/39 ... yes
3/40 ... yes
3/41 ... yes
3/42 ... yes
3/43 ... yes
3/44 ... yes
3/45 ... yes
3/46 ... yes
3/47 ... yes
3/48 ... yes
3/49 ... yes
3/50 ... yes
3/51 ... yes
3/52 ... yes
3/53 ... yes
3/54 ... yes
3/55 ... yes
3/56 ... yes
3/57 ... yes
3/58 ... yes
3/59 ... yes
3/60 ... yes
3/61 ... yes
83/62 ... yes
22/63 ... yes
91/64 ... yes
9/65 ... yes
8/66 ... yes
8/67 ... yes
3/68 ... yes
8/69 ... yes
8/71 ... yes
8/72 ... yes
8/73 ... yes
8/74 ... yes
8/75 ... yes
8/76 ... yes
8/77 ... yes
8/78 ... yes
8/79 ... yes
8/80 ... yes
21/82 ... yes
119/84 ... yes
8/86 ... yes
117/89 ... yes
9/94 ... yes
230/95 ... yes
22/96 ... yes
22/97 ... yes
4/98 ... yes
238/100 ... yes
117/101 ... yes
4/102 ... yes
251/103 ... yes
8/104 ... yes
117/106 ... yes
25/108 ... yes
273/109 ... yes
117/110 ... yes
4/112 ... yes
4/117 ... yes
117/118 ... yes
4/121 ... yes
312/122 ... yes
4/123 ... yes
Redis version >= 6.2.14? ... yes
Ruby version >= 3.0.6 ? ... yes (3.1.5)
Git user has default SSH configuration? ... yes
Active users: ... 52
Is authorized keys file accessible? ... yes
GitLab configured to store new projects in hashed storage? ... yes
All projects are in hashed storage? ... yes
Elasticsearch version 7.x-8.x or OpenSearch version 1.x ... skipped (Advanced Search is disabled)
All migrations must be finished before doing a major upgrade ... skipped (Advanced Search is disabled)
Checking GitLab App ... Finished
Checking GitLab subtasks ... Finished

Possible fixes

Ensure Gitlab only clears cookies for its own server name when user signs out. I am able to reproduce this from two separate gitlab servers in two separate subdomains, including a domain that is slightly different than our Mattermost chat server domain. To clarify, using a similar structure to ours, our chat server would be chat.program1.example.com. We have two gitlab servers gitlab.program1.example.com and gitlab.program2.example.com. If I connect to either gitlab server and log out of it, I am logged out of the Mattermost server as well.