Yeah, I think you are getting hit by this so much because you are getting challenged all the time instead of once a week.

If we solve that issue, this one will become a very small corner case.

But I am not sure why you are getting challenged all the time.
pagure.io isn't behind a network of proxies, it's got only one anubis instance so it shouldn't be possible to have two nodes with different signing keys or something.

@adamwill is also seeing this. I guess I can try looking at logs, but I think we may need debug logs in order to see much and thats likely to be a lot. ;(

Regarding the matter of Anubis prompting too much, I had left this comment on Matrix that might help when looking at debug logs:

I'm looking at places where anubis calls ClearCookie (defined in http.go) and I see there are associated log statements: "can't get challenge", "check failed", "can't get algorithm", "cookie not found", "cookie is invalid", "cookie is expired", "invalid token", "invalid token claims type", "policyRule claim is not a string", "user originally passed with a different rule, issuing new challenge", "JWT restriction header is invalid", "explicit deny", "CONFIG ERROR: unknown rule", "user has cookies disabled, this is not an anubis bug" :), "challenge validate call failed", "JWTRestrictionHeader is set in config but not found in request, please check your reverse proxy config.", "failed to sign JWT"

Some of them are logged as errors, but most are only logged with Debug log level so maybe those aren't printed by default? Anyway I guess decent chance one of those will be hit. Hopefully.

(It also breaks the Submit button on bodhi update creation page.)

This has also just hit me when attempting to submit a new issue, the anubis intercept threw away my new issue POSTd content. Luckily the browser had kept the form contents when navigating back and re-suibmitting.

I have also seen this now here (but only once or twice.)

Have higher priority fires right now, but we definitely need to get to the bottom of this. ;(

Sorry for the hassle.

I updated anubis on pagure.io on sunday.

Can any of you seeing this issue say if it's better or worse or the same?

The new version tries a lot harder to not challenge real people...

I'm currently seeing Anubis on src.fedoraproject.org but not on pagure.io. This is just based on my own browsing from the last hour or so, a pretty small sample size, but I'm cautiously optimistic.

Yeah, we had to downgrade anubis on src, but pagure.io still has the new 'try not to challenge as much' version.

I think this is solved now. Please re-open if you see it again and we can try more measures...

Yes, this is fixed.