Page MenuHomePhabricator

Clean up login.wikimedia.org ahead of SUL3 login
Closed, DeclinedPublic

Description

Reasons

Under normal circumstances, we currently do not serve any pages from login.wikimedia.org. Browsers do not load any pages from this domain during the login process, and we do not link to or promote pages on this domain anywhere. Exposure to this domain name is currently limited to brief flashes in the address bar (during login redirect bounces) or status bar (for the invisible autologin image pixel, or ajax requests).

As part of T348388: SUL3: Use a dedicated domain for login and account creation, we're likely to serve the login form from this domain login.wikimedia.org, as well as the 2FA form and WebAuthn form, which are an optional second page after the login form depending on the account configuration.

This means users are exposed to the logo, sidebar, and footer of this wiki during the login process, from which they may follow links. Also, if they navigate backward, or for any other reason turn back here whilst logged-in, they will also see their personal tools which link to a User page, User talk, Preferences, Contributions, etc.

Things to polish up

Screenshot 2024-01-06 at 22.52.51.png (2×2 px, 894 KB)

Wikimedia_Foundation_logo_-_vertical.svg.png (383×512 px, 11 KB)

  1. Logo. This is currently the (former) WMF logo, aka the Wikimedia community logo, with no text or branding, which to my knowledge is something a typical new user on specific wiki projects like Wikipedia or Wikidata will have no prior familiarity with, and also isn't self-explanatory.
    • Perhaps the current WMF logo would make more sense here, matching https://foundation.wikimedia.org, https://vote.wikimedia.org, https://donate.wikimedia.org/, etc
    • We may be able to, in the common case of just the login page, swap this out in some way, or e.g. hide entirely in favour of rendering the site logo of the wiki you're about to return to after redirect (e.g. the login form could read the returnto wiki ID and render that logo there). However, we still need a default for this wiki, for when you try to browse other pages here, or arrive here for other reasons.
  2. Sidebar. We can remove most of it probably? In the common case of the login page, or perhaps even for all logged out views / in the default skin, we could perhaps hide it entirely.
  3. Main Page. This absolutely needs some kind of content here. The wiki might also be a good candidate for $wgMainPageIsDomainRoot, or we could redirect / to Special:UserLogin, which is already capable of telling the user they are already logged-in.
    • Note that without some changes to the "already logged in" message, it doesn't tell the user where to go. Perhaps CentralAuth could offer a special page that's a better landing page, i.e. something that can leverage your "homewiki" field and prompt you to "return" there.
  4. Editing. Would it make sense to restrict editing in the same way as for closed wikis? I.e. only for stewards and global sysops basically. That would ensure no user pages and talk pages get created here.
  5. Footer. Remove most of it probably.
  6. Personal tools. We probably want to hide most of these to discourage browsing of User, User talk, Contributions.
  7. Preferences. Unsure. Hide? Keep? Point to meta/GlobalPreferences?
    • If keeping, consider what it would mean when someone goes there, the preceived meaning of those preferences, and the various other pages it links to. If keeping, we may want add most of its keys to $wgHiddenPrefs?

Other things to consider:

  • For "global" type things, we usually refer to Meta-Wiki as the default. This also empowers the community to take ownership of what is shown there and how it ties in with practices. Whenever possible, we should avoid duplicating or competing with pages or workflows there.
    • For example, instead of hiding the User link in the personal tools, we could perhaps make it point to your global user page on Meta-Wiki.
    • Likewise, global preferences, whilst managable from anywhere, are I think conceptually often thought of as belonging to Meta-Wiki.

Event Timeline

we could redirect / to Special:UserLogin

If you are already logged in, Special:UserLogin will suggest you to log in as another user unless there is a page to redirect to defined in URL parameter.

Also, by default the language of loginwiki is English.

Another thing is search bar. It becomes very prominent in Vector 2022.

We could also just set up a new wiki if that turns out to be easier. Most of the considerations would be the same but it wouldn't interfere with existing use of loginwiki (AIUI stewards use it to investigate cross-wiki abusers, although I'm not sure what that means in practice).

IMO we should try to hide the "wiki look" for the login page (use the API skin or something like that), along the lines of T71246: Provide a way to show OAuth authorization dialog with a layout appropriate for a popup. (BTW OAuth authorization should also move to loginwiki, although it doesn't have to happen at the same time.) It makes login less confusing, and it makes it possible to do it in a popup window on clients that support Javascript (T71596: Provide JavaScript login widget) which is how basically every other website does SSO. It would also make it easier to integrate FedCM which also involves using a popup window.
The drawback is that if something goes wrong with login/signup, and we fail to send back to the user, it's going to be more confusing (although it's going to be confusing anyway).

The changes proposed here are good ideas regardless (other than disabling user preferences, which I wouldn't bother with - if the user is loginwiki and they are able to see Special:Preferences, something already went wrong; and if someone goes there intenionally, *shrug* - I don't see why anyone would want to, but I don't see any harm in it either.)

One other thing we must do is disable anything that can be used as an attack vector to compromise the central session - disable gadgets, site scripts and user scripts, and either restrict or monitor the editing of the MediaWiki namespace. If we can establish the central session as reliable (to the extent deployed code is secure), we can rely on it to mitigate security risk from on-wiki hosted code on other wikis.

There is also the question of signup page customizations (such as communities adding links to the username policy, or GrowthExperiments adding a campaign-specific signup page for e.g. users coming from a donation banner). We'll probably pass an origin wiki and a language as URL parameters, and then what? Should we try to load the content of the relevant MediaWiki messages via a cross-wiki API request? (Doing a cross-wiki DB read and then trying to parse it on loginwiki seems like a bad idea.) Should we require those customizations to be done on loginwiki (where we want to make editing MediaWiki pages difficult in general)? Should we just remove the ability to have them?

Also some wikis have their own workflows for users stuck on the captcha, with an entry point in one of the captcha-related i18n messages, which we'd probably also want to port over. These messages are wiki-specific, not language-specific (and some large wikis might even want to support them in multiple languages) so even if wanted to make those wikis arrange to get loginwiki i18n messages changes, it wouldn't be straightforward how.

Also some non-Latin wikis have help messages related to input methods and fonts and such, we need to investigate whether we need to support that in some way (unlike wiki policies, it should be fairly straightforward to convert them to loginwiki i18n messages).

Also, users might arrive from a wiki using a language variant. Would the login page show up in the right language? I think the answer is "yes as long as it does not involve any message parsed from wikitext" but I am not really sure about it.

disable gadgets, site scripts and user scripts, and either restrict or monitor the editing of the MediaWiki namespace.

Note loginwiki already has fewer extension installed, see T61702: Examine which extensions are installed on login.wikimedia.org (loginwiki) and vote.wikimedia.org (votewiki), and Gadget is not installed there - but there are more extensions that can be dropped there, such as TheWikipediaLibrary, ReadingLists, ElectronPdfService and Kartographer.

Editing. Would it make sense to restrict editing in the same way as for closed wikis? I.e. only for stewards and global sysops basically. That would ensure no user pages and talk pages get created here.

This has already been the case for years.

An additional source of complication is that if we end up using RWS (T345589), we'd probably want to register loginwiki as a service domain, and one requirement for RWS service domains is that the top-level URL (ie. https://login.wikimedia.org/) must redirect away to a different domain.

Tgr changed the task status from Open to Stalled.Jul 31 2024, 10:58 PM

Probably won't need this since we are planning to do T363695: Create a Wikimedia login domain that can be served by any wiki instead of using loginwiki.

Probably won't need this since we are planning to do T363695: Create a Wikimedia login domain that can be served by any wiki instead of using loginwiki.

But changing password and password reset may still happen in loginwiki.

Should this be closed as Declined or Invalid?

From parent task:

We need to disable local login and use a central, single location where the user interacts with credentials. This includes at least login, signup, password change, password reset; arguably also bot passwords and OAuth.

A shared login domain only solved login and register issue. Did we decide not to use loginwiki for password and 2FA management?

Per T363695#10309189, we won't use loginwiki.

A shared login domain only solved login and register issue. Did we decide not to use loginwiki for password and 2FA management?

It doesn't make sense to use a different domain for login/registration and for password/2FA management. It would confuse password managers and break WebAuthn.