As of a couple hours ago (probably the new wmf13 deployment) my OAuth app breaks on attempts to log in via OAuth. After clicking 'allow', I get what I think is a JSON decode error, "JWT::DecodeError | Not enough or too many segments"
Description
Description
Details
Details
Customize query in gerrit
Related Objects
Related Objects
- Mentioned In
- T59576: GET call to Special:OAuth/$par without query strings (but with Authorization header) shouldn't be redirected to pretty URLs
T78314: Add tests against beta to catch OAuth integration issues
rOPUPb156921ce6e6: text varnish: pass all "Authorization: OAuth " requests
rMW5153eb27a994: Updated mediawiki/core Project: mediawiki/extensions/OAuth…
rEOAU7066ab7c14bf: Prevent canonical redirect when OAuth is in use
rEOAUb1b824cb3c98: Prevent canonical redirect when OAuth is in use
rMEXTc45794472ded: Updated mediawiki/extensions Project: mediawiki/extensions/OAuth… - Mentioned Here
- P931 (An Untitled Masterwork)
T67402: URLs for the same title without extra query parameters should have the same canonical link
Event Timeline
Comment Actions
The Omniauth-mediawiki gem, https://github.com/timwaters/omniauth-mediawiki, breaks because of newly introduced redirection. There's a response object that was previously handled fine, and now it's an unexpected 301 Moved Permanently response.
Comment Actions
Change 223952 had a related patch set uploaded (by BryanDavis):
Prevent canonical redirect when OAuth is in use
Comment Actions
Change 223961 had a related patch set uploaded (by Gergő Tisza):
Prevent canonical redirect when OAuth is in use
Comment Actions
The app breaks at line 82 of the OAuth gem: https://github.com/timwaters/omniauth-mediawiki/blob/master/lib/omniauth/strategies/mediawiki.rb#L82
Instead of the expected data, it's a Net:HTTPPermanentRedirect
Comment Actions
gtisza@GergoTisza:~$ curl -sSv -o/dev/null 'https://en.wikipedia.org/w/index.php?title=Special:OAuth/identify' (...) < HTTP/1.1 301 Moved Permanently * Server nginx/1.9.2 is not blacklisted < Server: nginx/1.9.2 < Date: Thu, 09 Jul 2015 21:50:10 GMT < Content-Type: text/html; charset=utf-8 < Transfer-Encoding: chunked < Connection: keep-alive < X-Powered-By: HHVM/3.6.1 < X-Content-Type-Options: nosniff < Vary: Accept-Encoding,X-Forwarded-Proto,Cookie < Location: https://en.wikipedia.org/wiki/Special:OAuth/identify < Last-Modified: Thu, 09 Jul 2015 21:50:10 GMT < X-Varnish: 4239197068, 3689971860, 3766942613 < Via: 1.1 varnish, 1.1 varnish, 1.1 varnish < Age: 0 < X-Cache: cp1054 miss (0), cp4017 miss (0), cp4017 frontend miss (0) < Strict-Transport-Security: max-age=31536000 < Cache-Control: private, s-maxage=0, max-age=0, must-revalidate < Set-Cookie: GeoIP=US:CA:San_Francisco:37.7898:-122.3942:v4; Path=/; Domain=.wikipedia.org < X-Analytics: https=1 < Set-Cookie: WMF-Last-Access=09-Jul-2015;Path=/;HttpOnly;Expires=Mon, 10 Aug 2015 12:00:00 GMT
Comment Actions
gtisza@GergoTisza:~$ curl -sSv -o/dev/null 'https://en.wikipedia.org/w/index.php?title=Special:OAuth/identify&&&&&&&&&&&&&&&&&' |& grep -P 'HTTP/|Location|X-Cache' > GET /w/index.php?title=Special:OAuth/identify&&&&&&&&&&&&&&&&& HTTP/1.1 < HTTP/1.1 301 Moved Permanently < Location: https://en.wikipedia.org/wiki/Special:OAuth/identify < X-Cache: cp1055 miss (0), cp4018 miss (0), cp4017 frontend miss (0) gtisza@GergoTisza:~$ curl -sSv -o/dev/null 'https://en.wikipedia.org/w/index.php?title=Special:OAuth/identify&&&&&&&&&&&&&&&&&' |& grep -P 'HTTP/|Location|X-Cache' > GET /w/index.php?title=Special:OAuth/identify&&&&&&&&&&&&&&&&& HTTP/1.1 < HTTP/1.1 301 Moved Permanently < Location: https://en.wikipedia.org/wiki/Special:OAuth/identify < X-Cache: cp1055 miss (0), cp4018 miss (0), cp4017 frontend hit (1) gtisza@GergoTisza:~$ curl -sSv -o/dev/null -H 'Authorization: OAuth fake="yes"' 'https://en.wikipedia.org/w/index.php?title=Special:OAuth/identify&&&&&&&&&&&&&&&&&' |& grep -P 'HTTP/|Location|X-Cache' > GET /w/index.php?title=Special:OAuth/identify&&&&&&&&&&&&&&&&& HTTP/1.1 < HTTP/1.1 301 Moved Permanently < Location: https://en.wikipedia.org/wiki/Special:OAuth/identify < X-Cache: cp1055 miss (0), cp4018 miss (0), cp4017 frontend hit (2)
The 301 gets cached in Varnish which ignores Cache-Control: private and does not vary on the Authorization header.
Comment Actions
http://dashboard-testing.wikiedu.org/ seems to work again now. We are still debating if there are cached 301 responses in Varnish that will need to be forced out of cache.
Comment Actions
Change 223980 had a related patch set uploaded (by Gergő Tisza):
Never canonicalize Special:OAuth URLs
Comment Actions
Recap of IRC discussion: MediaWiki sends Cache-control: s-maxage=1200, must-revalidate, max-age=0 on its tryNormalizeRedirect 301s (which is completely independent from the Cache-Control header that's put by Varnish on outgoijng requests). Varnish would normally ignore that because it doesn't cache requests with an Authorization header (the RfC allows but does not require caching of authorization-enabled requests with cache-control: public) but it seems like we tell it not to; that should probably be fixed.
The current state is that requests without an OAuth header get redirected and that redirect gets cached and that affects subsequent requests even if they have an OAuth header. (See P931 for a reproduction.) There is no non-OAuth traffic going to Special:OAuth/identify which is the only affected endpoint, so this is no immediate priority, but should be fixed soon.
Comment Actions
Change 223997 had a related patch set uploaded (by BBlack):
text varnish: pass all "Authorization: OAuth " requests
Comment Actions
Change 223997 merged by BBlack:
text varnish: pass all "Authorization: OAuth " requests
Comment Actions
Change 223980 abandoned by Gergő Tisza:
Never canonicalize Special:OAuth URLs
Reason:
Obsoleted by I805cbc12792411395073cbc404ba7430867c8ecc