Remove cookie settings from mw.config
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	DannyS712
	Sep 26 2021, 12:04 AM

Description

Currently, on all responses mw.config includes configuration variables wgCookiePrefix, wgCookieDomain, wgCookiePath, and wgCookieExpiration. These are documented[1] as being

@internal For mediawiki.cookie

However, since rMWa0370fe3c958: mediawiki.cookie: Export config via packageFiles by @Krinkle, mediawiki.cookie doesn't use mw.config to retrieve these settings, but rather they are injected via packageFiles. Thus, they should no longer be needed in mw.config.

Per codesearch, there are no uses in deployed javascript: https://codesearch.wmcloud.org/deployed/?q=wgCookie(Prefix%7CDomain%7CPath%7CExpiration)&i=nope&files=%5C.js%24&excludeFiles=&repos=

However, a number of non-deployed extensions still use these, so an entry in the release notes is probably a good idea: https://codesearch.wmcloud.org/search/?q=wgCookie(Prefix%7CDomain%7CPath%7CExpiration)&i=nope&files=%5C.js%24&excludeFiles=&repos=

[1] https://gerrit.wikimedia.org/g/mediawiki/core/+/3ff9183d2453413e7c8c550232918d11cfd1eb1b/includes/resourceloader/ResourceLoader.php#1979

Details

	Subject	Repo	Branch	Lines +/-
	Remove cookie settings from mw.config	mediawiki/core	master	+6 -6

Customize query in gerrit

Related Objects

Mentioned Here: rMWa0370fe3c958: mediawiki.cookie: Export config via packageFiles

Event Timeline

DannyS712 created this task.Sep 26 2021, 12:04 AM

Restricted Application added a project: User-DannyS712. · View Herald TranscriptSep 26 2021, 12:04 AM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

DannyS712 moved this task from Unsorted to Next on the User-DannyS712 board.Sep 26 2021, 12:04 AM

Change 724381 had a related patch set uploaded (by DannyS712; author: DannyS712):

[mediawiki/core@master] Remove cookie settings from mw.config

https://gerrit.wikimedia.org/r/724381

gerritbot added a project: Patch-For-Review.Sep 28 2021, 7:17 PM

Used by some onwiki scripts that should be fixed (notably sitewide scripts on mwlwiki, nlwikimedia, ptwiki)

@DannyS712 Hi. Re: Tech News - What would you suggest as the content, and When should it be included?
(I'm currently editing the edition that is due to be frozen-for-translations tomorrow (~25hours from now), and to be delivered on Monday). Thanks!

In T291760#7392339, @Quiddity wrote:

@DannyS712 Hi. Re: Tech News - What would you suggest as the content, and When should it be included?
(I'm currently editing the edition that is due to be frozen-for-translations tomorrow (~25hours from now), and to be delivered on Monday). Thanks!

Lets wait until at least next week. As for content, something also the lines of

The JavaScript mw.config no longer contains the values for wgCookiePrefix, wgCookieDomain, wgCookiePath, and wgCookieExpiration. These had previously be documented as for internal use and were not part of the "stable" variables available for use in wiki JavaScript.

In T291760#7392744, @DannyS712 wrote:

In T291760#7392339, @Quiddity wrote:

@DannyS712 Hi. Re: Tech News - What would you suggest as the content, and When should it be included?
(I'm currently editing the edition that is due to be frozen-for-translations tomorrow (~25hours from now), and to be delivered on Monday). Thanks!

Lets wait until at least next week. As for content, something also the lines of

The JavaScript mw.config no longer contains the values for wgCookiePrefix, wgCookieDomain, wgCookiePath, and wgCookieExpiration. These had previously be documented as for internal use and were not part of the "stable" variables available for use in wiki JavaScript.

Actually, you can probably announce now that they will be removed soon

The JavaScript mw.config will soon no longer contain the values for wgCookiePrefix, wgCookieDomain, wgCookiePath, and wgCookieExpiration. These are currently documented as for internal use and are not part of the "stable" variables available for use in wiki JavaScript.

Quiddity moved this task from To Triage to In current Tech/News draft on the User-notice board.Sep 30 2021, 8:13 PM

I think we can leave out the internal reason. The "internal" description may sound unfair because using these was previously the only way to store cookies in a wgCookie-compliant way. Instead, perhaps we can mention what the modern replacement is. Something like:

The JavaScript variables wgCookiePrefix, wgCookieDomain, wgCookiePath, and wgCookieExpiration will soon be removed from mw.config. Scripts should instead use mw.cookie from the "mediawiki.cookie" module. (Documentation, T291760)