Page MenuHomePhabricator

Support bot passwords in the REST API
Closed, ResolvedPublic

Description

Currently, bot passwords don’t support the REST API: the session provider only enables itself when using the action API (and with $wgEnableBotPasswords, of course), so if you try to log in using the action API and then make REST API requests with the same cookies, you’ll find your session is gone and you’re anonymous again. I assume this is unintentional.

Details

Event Timeline

Change 697430 had a related patch set uploaded (by Lucas Werkmeister (WMDE); author: Lucas Werkmeister (WMDE)):

[mediawiki/core@master] Support REST API in BotPasswordSessionProvider

https://gerrit.wikimedia.org/r/697430

Change 698517 had a related patch set uploaded (by Lucas Werkmeister (WMDE); author: Lucas Werkmeister (WMDE)):

[mediawiki/extensions/WikibaseLexeme@master] selenium: Use ChronologyProtector cookie in mwbot

https://gerrit.wikimedia.org/r/698517

Change 698517 had a related patch set uploaded (by Lucas Werkmeister (WMDE); author: Lucas Werkmeister (WMDE)):

[mediawiki/extensions/WikibaseLexeme@master] selenium: Use ChronologyProtector cookie in mwbot

https://gerrit.wikimedia.org/r/698517

Disregard that, wrong task ID.

Change 697430 merged by jenkins-bot:

[mediawiki/core@master] Support REST API in BotPasswordSessionProvider

https://gerrit.wikimedia.org/r/697430

Lucas_Werkmeister_WMDE claimed this task.

I don’t have a setup to conveniently test this anymore, but I’m pretty sure I tested my patch at the time. Let’s assume it’s working and close the task.