It seems $wgLocalVirtualHosts doesn't include .wikimedia.org in wmf-config/CommonSettings.php. The entry was commented out in 2008. And I'm sure there are many other reasons (more non-wikis under .wikimedia.org).

However, aside from Meta-Wiki and Wikimedia Commons, there are no other .wikimedia.org domains listed. At the very least we should probably include login.wikimedia.org.

What does this variable actually do? Two things:

/**
 * Local virtual hosts.
 *
 * This lists domains that are configured as virtual hosts on the same machine.
 *
 * This affects the following:
 * - MWHttpRequest: If a request is to be made to a domain listed here, or any
 *   subdomain thereof, then no proxy will be used.
 *   Command-line scripts are not affected by this setting and will always use
 *   proxy if it is configured.
 * - ChronologyProtector: Decide to shutdown LBFactory asynchronously instead
 *   synchronously if the current response redirects to a local virtual host.
 */
array $wgLocalVirtualHosts

The latter was introduced in a series of commits to both fix bugs with CentralAuth and cross-wiki redirects in some cases, as well as to improve performance in others (no needless blocking).

• rMWc954a4efe8cd: Use cpPosTime cookie for same-domain redirects on DB change
• rMWa3dacac90f19: Support masking the WRITE_SYNC latency from ChronologyProtector

Given logging in involves redirects and login.wikimedia.org, I guess this might mean this code isn't running as it was intended. We should understand the impact of this not being configured as such, and (if okay) add it.

I also noticed wikidata.org notably absent from the list.