1c52aaa92828b6ecc18dd5800fe6650b91daf696
max
  Fri Sep 18 07:22:10 2026 -0700
hgSession: the new Sessions page also lists the sessions saved on our other servers

#Preview2 week - bugs introduced now will need a build patch to fix
Every geo mirror node keeps its own namedSessionDb, so a session saved on
genome-euro is invisible on genome.ucsc.edu and people do not find it again.
The table now holds the sessions from every node, with a new Server column
saying where each one lives, and the session name links to the server that
holds it.

Two new hgSession actions, both answered in main() before the cart is built,
so that a request from another node leaves no cart, userDb or sessionDb row
behind:

hgS_doSessionListJson  returns this server's sessions for the user named by
the login cookie, as JSON.  This is what the other
nodes call.
hgS_doMirrorSessions   asks every other gbNode for that list and returns
what came back.  It sends all of the requests before
reading any of the answers, so the wait is the
slowest node rather than the sum of them.

The fetch goes through our own server rather than from the browser to the
other nodes, which keeps cross-origin requests out of it: apache handles the
CORS headers differently on every node, and the two mirrors are administered
by Bielefeld and RIKEN, while CGI code reaches them with the release.  The
user's login cookies, and only those, are passed on (wikiLinkLoginCookieHeader),
which works because the nodes share a cookie salt.

The page never waits for any of this: the table is drawn from this server's
own sessions and the rows from the other servers are merged in as they
arrive, keeping the current sort, search and page.  A node that does not
answer, times out, or runs a release without the endpoint is named in a line
under the toolbar instead, and costs nothing else.

Sessions from another server are shown but not managed here: no Share, Edit,
Overwrite or Delete, no bulk-select checkbox, and the Update now shortcut
keeps ignoring them.  Table rows are keyed by a new uid rather than by the
session name, since the same name can now be in the table twice, once per
server.

geoMirrorThisNode() and geoMirrorOtherNodes() read the node list from the
hgcentral gbNode table, so nothing new has to be configured: browser.node
already says which node a server is.

diff --git src/hg/lib/wikiLink.c src/hg/lib/wikiLink.c
index 218199ba3c3..e10e7d2070d 100644
--- src/hg/lib/wikiLink.c
+++ src/hg/lib/wikiLink.c
@@ -53,30 +53,50 @@
 
 static char *wikiLinkLoggedInCookie()
 /* Return the cookie name specified in hg.conf as the wiki logged-in cookie, or a default.
  * Do not free result. */
 {
 return cfgOptionDefault(CFG_WIKI_LOGGED_IN_COOKIE, "hgLoginIdKey");
 }
 
 static char *wikiLinkUserNameCookie()
 /* Return the cookie name specified in hg.conf as the wiki user name cookie, or a default.
  * Do not free result.. */
 {
 return cfgOptionDefault(CFG_WIKI_USER_NAME_COOKIE, "hgLoginUserName");
 }
 
+char *wikiLinkLoginCookieHeader()
+/* Return a "Cookie:" header line that passes this request's login cookies - and only those, not
+ * the cart cookie - on to another one of our servers, or NULL if the request carries no login
+ * cookies.  Free when done. */
+{
+char *userCookie = wikiLinkUserNameCookie();
+char *keyCookie = wikiLinkLoggedInCookie();
+char *userVal = findCookieData(userCookie);
+char *keyVal = findCookieData(keyCookie);
+if (isEmpty(userVal) || isEmpty(keyVal))
+    return NULL;
+/* A cookie value with a newline in it could add headers of its own to the request we are about
+ * to write.  Browsers do not send such a value; something else did, so send nothing. */
+if (strpbrk(userVal, "\r\n") != NULL || strpbrk(keyVal, "\r\n") != NULL)
+    return NULL;
+struct dyString *dy = dyStringNew(256);
+dyStringPrintf(dy, "Cookie: %s=%s; %s=%s\r\n", userCookie, userVal, keyCookie, keyVal);
+return dyStringCannibalize(&dy);
+}
+
 static char *getLoginCookieSalt()
 /* Return the secret salt that we hash with userName to verify cookie key, NULL if undefined. */
 {
 return cfgOption(CFG_LOGIN_COOKIE_SALT);
 }
 
 static uint getCookieIdxOrKey(char **retKey)
 /* The LoggedIn cookie value may be NULL, a number <idx>, or a long string <key>.
  * If value is NULL/empty, return 0 and set *retKey to NULL;
  * If value is just a number, return the number and set *retKey to NULL.
  * Otherwise return 0 and set *retKey to the cookie value. */
 {
 uint idx = 0;
 char *key = NULL;
 char *cookieIdKeyStr = findCookieData(wikiLinkLoggedInCookie());