Page MenuHomePhabricator

Create an API endpoint to allow getting information about a user's all active IP addresses
Closed, InvalidPublic

Description

In T263635 we introduced the concept of a subject. This is the IP Address, User, or Range (?) that is being requested.

We do not want to allow for any IP address to be looked up, but it might simplify things if a user could be looked up directly and return all of the info from all of their IP addresses.

This could be helpful when T262321: IP Masking is implemented, but assumes there will be a way to lookup an anonymous user by their identifier (i.e. it is not a hash of some kind).

Event Timeline

Niharika renamed this task from Create an API endpoint that accepts a subject to Create an API endpoint to allow getting information about a user's all active IP addresses.Oct 7 2020, 3:42 PM
Niharika subscribed.

@dbarratt Does the title rename make sense? Trying to get a sense of what we'll achieve from implementing this API endpoint.

@dbarratt Does the title rename make sense? Trying to get a sense of what we'll achieve from implementing this API endpoint.

My thinking was that this endpoint would only be useful if Anon Users are queryable.

For instance, right now you might go to Special:Contribs/127.0.0.1 What happens when this changes to Special:Contribs/Anon 123 ? If anon users are more like IP addresses, then you'd get a single IP info, if they are more like users, you'd get multiple results (since they may have more than one IP address).

If anon users cannot be queried (because they are a hash), then this endpoint wouldn't work at all.

However, this could be useful for Checkusers to use on non-Anon users (depending on if/how we would log such info).

Does that help?

@dbarratt I think so! Should we stall this task until we have determined how anon identifiers will work post T262321: IP Masking?

@dbarratt I think so! Should we stall this task until we have determined how anon identifiers will work post T262321: IP Masking?

That seems wise. Right now we are assuming that we will not be able to query an anon user (i.e. it is some sort of hash of an IP) which is the most conservative assumption, but that could change which would simplify our code.