When Twitter thought it was 2015 already and logged everybody out

I MITMed Twitter for Android's login to see why it was failing. The Twitter servers think it's 2015. Amazing. pic.twitter.com/iEu4rEUub9

— Ninji the [REDACTED] (@_Ninji) December 29, 2014

Today users of Twitter could not log in via OAuth for a few hours. As seen in the screenshot above Twitter was already thinking it was 2015.

Culprit is that Twitter was formatting dates using the ISO-8601 year number. In PHP it’s the difference between using Y and o:

o — ISO-8601 year number. This has the same value as Y, except that if the ISO week number (W) belongs to the previous or next year, that year is used instead.

As the current ISO-8601 week number is 1 (due to next Thursday being January 1, 2015) the current week officially is “the first week of 2015”. Therefore the ISO-8601 year number for this week is 2015, and not 2014.

$ php -r "echo date('Y', strtotime('2014-12-29'));"
2014

$ php -r "echo date('o', strtotime('2014-12-29'));"
2015

Ooops 🙂