Page MenuHomePhabricator
Create Task
Maniphest T197153

Make some providers optional for reauthentication
Closed, ResolvedPublic
Actions

Description

We require reauthentication for security-sensitive operations; that gets annoying if we use it for a lot of things, and extra annoying for people who have more secure logins (e.g. long random passwords they need to look up in a password manager, or two-factor authentication). We should make it possible for providers to act differently during reauthentication (some ideas here) and make reauthentication shorter:

  • no need for login captcha (where enabled)
  • maybe no need for second factor?
  • or maybe when there is a second factor no need for the password?

See also:

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
AuthManager: Modify security level handlingGergő Tiszamediawiki/coremaster+974 -108
Customize query in gerrit

Related Objects
Search...

Event Timeline

Tgr created this task.Jun 13 2018, 5:09 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 13 2018, 5:09 PM
Tgr mentioned this in T197160: All security-sensitive MediaWiki functionality should require elevated security.Jun 13 2018, 5:22 PM
Tgr added a parent task: T197160: All security-sensitive MediaWiki functionality should require elevated security.Jun 13 2018, 5:24 PM
Rxy subscribed.Jun 13 2018, 7:58 PM
• Vvjjkkii renamed this task from Make some providers optional for reauthentication to u2aaaaaaaa.Jul 1 2018, 1:04 AM
• Vvjjkkii triaged this task as High priority.
• Vvjjkkii added projects: CheckUser, Connected-Open-Heritage-Batch-uploads (RAÄ-KMB_1_2017-02), Tamil-Sites, Gamepress, Hashtags, Jade, KartoEditor, Language-2018-Apr-June, New-Editor-Experiences, Mail, TCB-Team (now WMDE-TechWish).
• Vvjjkkii updated the task description. (Show Details)
• Vvjjkkii removed a subscriber: Aklapper.
Ankry renamed this task from u2aaaaaaaa to Make some providers optional for reauthentication.Jul 1 2018, 4:22 PM
Ankry raised the priority of this task from High to Needs Triage.
Ankry removed projects: TCB-Team (now WMDE-TechWish), Mail, New-Editor-Experiences, Language-2018-Apr-June, KartoEditor, Jade, Hashtags, Gamepress, Tamil-Sites, Connected-Open-Heritage-Batch-uploads (RAÄ-KMB_1_2017-02), CheckUser.
Ankry updated the task description. (Show Details)
Ankry added a subscriber: Aklapper.
Tgr mentioned this in T201784: Implement option "require two-factor authentication only for dangerous actions".Aug 13 2018, 6:01 AM
He7d3r subscribed.Aug 13 2018, 11:38 AM
• Phabricator_maintenance added a project: acl*security.Sep 20 2018, 9:15 AM
Tgr updated the task description. (Show Details)Sep 23 2018, 11:56 PM
Tgr mentioned this in T203325: BotPasswords right selection form shows plain-text html.
Tgr mentioned this in T207557: Don't count initial login as valid for any operation that requires reauth.Oct 29 2018, 9:27 PM
Tgr mentioned this in T208667: Tie reauthentication (login with elevated security) to a specific security level.Nov 4 2018, 4:45 AM
Tgr added a subtask: T208668: Do not ask for password on reauthentication when 2FA is enabled.Nov 4 2018, 6:04 AM
gerritbot subscribed.Nov 5 2018, 12:09 AM

Change 471664 had a related patch set uploaded (by Gergő Tisza; owner: Gergő Tisza):
[mediawiki/core@master] [WIP] AuthManager: Modify security level handling

https://gerrit.wikimedia.org/r/471664

gerritbot added a project: Patch-For-Review.Nov 5 2018, 12:09 AM
Tgr added a subtask: T168557: "Keep me logged in" check box shouldn't be shown when a logged-in user is being verified.Nov 6 2018, 12:27 AM
AfroThundr3007730 subscribed.Nov 26 2018, 12:52 AM
Tgr added a project: User-Tgr.Dec 8 2018, 4:54 AM
Tgr moved this task from Backlog to Next on the User-Tgr board.Feb 23 2019, 7:19 AM
Tgr mentioned this in T222849: OATHAuth disable 2fa doesn't properly check getLoginSecurityLevel().May 10 2019, 6:26 AM
Aklapper removed a project: Security-Core.Nov 27 2019, 12:42 PM
• chasemp triaged this task as Medium priority.Dec 9 2019, 4:55 PM
• chasemp added a project: Security.Feb 10 2020, 10:58 PM
• chasemp removed a project: acl*security.Feb 20 2020, 8:07 PM
Pppery edited projects, added: Patch-Needs-Improvement; removed: Patch-For-Review.Mar 27 2023, 2:13 AM
Tgr mentioned this in T203256: OATH (2FA) needs an option to remember device but not keep user logged in.Jun 28 2025, 8:19 AM
Wellverywell subscribed.Mar 6 2026, 11:34 AM
Restricted Application added a project: MediaWiki-Core-Platform-Team. · View Herald TranscriptMar 6 2026, 11:34 AM
Tgr added a comment.Mar 9 2026, 11:53 AM

While we are making reauthentication more explicitly understood by AuthManager, we should also improve how it is logged.

Krinkle moved this task from Inbox, needs triage to Kanban on the MediaWiki-Core-Platform-Team board.Mar 10 2026, 4:20 PM
Krinkle edited projects, added: MediaWiki-Core-Platform-Team (Kanban); removed: MediaWiki-Core-Platform-Team.
Krinkle mentioned this in T136101: Rethink AuthManager::securitySensitiveOperationStatus.Mar 10 2026, 4:39 PM
gerritbot added a comment.Mar 30 2026, 1:20 PM

Change #471664 abandoned by Hashar:

[mediawiki/core@master] AuthManager: Modify security level handling

https://gerrit.wikimedia.org/r/471664

gerritbot added a comment.Mar 30 2026, 11:29 PM

Change #471664 restored by Thcipriani:

[mediawiki/core@master] AuthManager: Modify security level handling

https://gerrit.wikimedia.org/r/471664

gerritbot added a project: Patch-For-Review.Mar 30 2026, 11:29 PM
Restricted Application removed a project: Patch-Needs-Improvement. · View Herald TranscriptMar 30 2026, 11:29 PM
Pppery edited projects, added: Patch-Needs-Improvement; removed: Patch-For-Review.Mar 31 2026, 1:20 AM
Wellverywell mentioned this in T197137: Editing sitewide JS/CSS pages should require elevated security.Apr 16 2026, 4:13 AM
Johannnes89 subscribed.Apr 16 2026, 5:09 AM
Novem_Linguae subscribed.Apr 16 2026, 6:40 AM
MBH subscribed.Apr 16 2026, 9:14 AM
Nux subscribed.Apr 16 2026, 9:33 AM
Nirmos subscribed.Apr 17 2026, 6:31 AM
A_smart_kitten subscribed.May 20 2026, 12:32 PM

(for the record, https://gerrit.wikimedia.org/r/c/mediawiki/core/+/471664 was merged on 2026-05-19. it seems like @gerritbot didn't comment about it here for some reason)

sbassett subscribed.Jun 15 2026, 3:10 PM
In T197153#11940437, @A_smart_kitten wrote:

(for the record, https://gerrit.wikimedia.org/r/c/mediawiki/core/+/471664 was merged on 2026-05-19. it seems like @gerritbot didn't comment about it here for some reason)

Yes, that was a large chunk of this work, but we also need to complete T427950 to call this done, I believe.

Tgr closed subtask T168557: "Keep me logged in" check box shouldn't be shown when a logged-in user is being verified as Resolved.Jul 2 2026, 9:32 AM
Tgr added a comment.Jul 2 2026, 9:38 AM
In T197153#11687412, @Tgr wrote:

While we are making reauthentication more explicitly understood by AuthManager, we should also improve how it is logged.

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikimediaCustomizations/+/1306140 adds security level to goodpass/badpass logs. We should probably review how it gets / should get logged in core, as well.

sbassett closed subtask T208668: Do not ask for password on reauthentication when 2FA is enabled as Declined.Jul 6 2026, 9:58 PM
Tgr added a comment.Jul 7 2026, 10:15 AM

The subtasks are all done. Should we disable EmailAuth and captchas for reauth? Not sure it's worth it - EmailAuth and traditional captchas are unlikely to be shown during reauth, hCaptcha is low-friction, and they do have some security value, especially in the case when the user has nothing but a password to reauth with.

sbassett changed the status of subtask T208668: Do not ask for password on reauthentication when 2FA is enabled from Declined to Resolved.Jul 7 2026, 1:53 PM
Catrope subscribed.Jul 7 2026, 5:09 PM
In T197153#12093703, @Tgr wrote:

The subtasks are all done. Should we disable EmailAuth and captchas for reauth? Not sure it's worth it - EmailAuth and traditional captchas are unlikely to be shown during reauth, hCaptcha is low-friction, and they do have some security value, especially in the case when the user has nothing but a password to reauth with.

I think you're right that it's not worth it. They're unlikely to be shown during a reauth, and in situations where they are, something odd is going on, and the additional checks are probably a (security) feature rather than a bug.

Catrope closed this task as Resolved.Jul 7 2026, 5:10 PM
Catrope assigned this task to Tgr.

The task as described is done now. Individual providers can now detect that the login is a reauth by looking for the presence of an ElevatedSecurityAuthenticationRequest and abstain if there is one, and some providers do that now.

sbassett removed a project: Patch-Needs-Improvement.Jul 7 2026, 5:10 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits