Page MenuHomePhabricator

Clarify and fix QuickStatements configuration
Closed, ResolvedPublic5 Estimated Story Points

Description

Current Situation:
The documentation for QuickStatements, both in the Docker image READMEwe indicate that the user should set WB_PUBLIC_SCHEME_HOST_AND_PORT to "Host and port of Wikibase as seen by the user's browser". However, for QuickStatements OAuth to work this address also needs to be accessible inside the Docker network in a Docker compose environment such as we have provided in our example. Docker service names without an additional tool or special configuration on a user's machine will not be accessible in the "user's browser".

Once an address is configured which is accessible both inside and outside the service in a Docker Compose context, OAuth will work.

Goal:
Make Quickstatements oauth work in example configuration.

Acceptance Criteria:
Determine if there is a way to configure QuickStatements to work with an address which is strictly used internally by requests issued by the service, and one that is only used for links or redirects happening externally in the user's browser:

  • If this is possible, correct the current environment variables usage within the QuickStatements image Docker setup (i.e. Docker/build/QuickStatements/*) to make WIKIBASE_SCHEME_AND_HOST be only used internally, and WB_PUBLIC_SCHEME_HOST_AND_PORT and QS_PUBLIC_SCHEME_HOST_AND_PORT only ever used for things which happen in the user's browser.
  • If this isn't possible. then amend the documentation both on the QuickStatements docker image and in /example to clarify the use of these variables along with a suggestion or two about how to configure an address that is accessible both inside and outside the Docker service.

Notes:

  • The issue may well be with our image instead of the example config

Event Timeline

lojo_wmde updated the task description. (Show Details)
darthmon_wmde set the point value for this task to 5.

After googling, trial-and-error, careful line-by-line debugging in the Quickstatements and Magnustools code, and testing against old releases of WBS, I've concluded that Quickstatements OAuth without a URL which can be seen both within Docker and outside of it, has never worked.

I could be still be wrong, but I've certainly never found a way to make it work, and searching into numerous relevant discussions not found a single case where someone said definitely that they ever have seen it work. Furthermore I'm starting to think that it doesn't make sense for it to work due to cross domain issues. The OAuth request is happening from one domain in the Docker world and another with the Public URL. I believe the resulting nonce and/or cookies will not be valid between both domains. There may be some clever and still secure way to handle this, but I don't see it the Quickstatements code, and don't have any great ideas for what that would look like.

Some related conversations:

https://github.com/wmde/wikibase-release-pipeline/issues/282
https://stackoverflow.com/questions/62816363/why-does-the-query-service-in-my-wikibase-installed-through-docker-not-contain-c
https://phabricator.wikimedia.org/T267812
https://phabricator.wikimedia.org/T315916

Basic work completed in:

https://github.com/wmde/wikibase-release-pipeline/pull/564

Additional PRs which brings to Example the reverse proxy service and routable subdomains which are needed to make it work. Also adds example/wbs helper/installer script:

https://github.com/wmde/wikibase-release-pipeline/pull/563
https://github.com/wmde/wikibase-release-pipeline/pull/562

lojo_wmde claimed this task.
lojo_wmde moved this task from In Review to Done on the Wikibase Suite Team (Sprint-∞) board.