TypeError: Argument 1 passed to MediaWiki\Extension\CentralAuth\CentralAuthTokenManager::consume() must be of the type string, null given
Closed, ResolvedPublicPRODUCTION ERROR
Actions

Assigned To

Authored By

	hashar
	Aug 28 2024, 9:02 AM

Description

Error

service.version: 1.43.0-wmf.20
trace.id: 086184ef-80c2-4373-9cc3-7f65e4529aca
Find trace.id in Logstash

labels.normalized_message

[{reqId}] {exception_url}   TypeError: Argument 1 passed to MediaWiki\Extension\CentralAuth\CentralAuthTokenManager::consume() must be of the type string, null given, called in /srv/mediawiki/php-1.43.0-wmf.20/extensions/CentralAuth/includes/session/Centr

error.stack_trace

from /srv/mediawiki/php-1.43.0-wmf.20/extensions/CentralAuth/includes/CentralAuthTokenManager.php(157)
#0 /srv/mediawiki/php-1.43.0-wmf.20/extensions/CentralAuth/includes/session/CentralAuthTokenSessionProvider.php(176): MediaWiki\Extension\CentralAuth\CentralAuthTokenManager->consume(null, string)
#1 /srv/mediawiki/php-1.43.0-wmf.20/extensions/CentralAuth/includes/session/CentralAuthApiSessionProvider.php(95): CentralAuthTokenSessionProvider->consumeToken(null)
#2 /srv/mediawiki/php-1.43.0-wmf.20/includes/HookContainer/HookContainer.php(159): CentralAuthApiSessionProvider->onApiCheckCanExecute(ApiQuery, MediaWiki\User\User, string)
#3 /srv/mediawiki/php-1.43.0-wmf.20/includes/api/ApiHookRunner.php(76): MediaWiki\HookContainer\HookContainer->run(string, array)
#4 /srv/mediawiki/php-1.43.0-wmf.20/includes/api/ApiMain.php(1778): MediaWiki\Api\ApiHookRunner->onApiCheckCanExecute(ApiQuery, MediaWiki\User\User, string)
#5 /srv/mediawiki/php-1.43.0-wmf.20/includes/api/ApiMain.php(1934): ApiMain->checkExecutePermissions(ApiQuery)
#6 /srv/mediawiki/php-1.43.0-wmf.20/includes/api/ApiMain.php(895): ApiMain->executeAction()
#7 /srv/mediawiki/php-1.43.0-wmf.20/extensions/PageImages/includes/PageImages.php(291): ApiMain->execute()
#8 /srv/mediawiki/php-1.43.0-wmf.20/extensions/PageImages/includes/PageImages.php(256): PageImages\PageImages::getImages(array, int)
#9 /srv/mediawiki/php-1.43.0-wmf.20/includes/HookContainer/HookContainer.php(159): PageImages\PageImages->onApiOpenSearchSuggest(array)
#10 /srv/mediawiki/php-1.43.0-wmf.20/includes/api/ApiHookRunner.php(170): MediaWiki\HookContainer\HookContainer->run(string, array)
#11 /srv/mediawiki/php-1.43.0-wmf.20/includes/api/ApiOpenSearch.php(118): MediaWiki\Api\ApiHookRunner->onApiOpenSearchSuggest(array)
#12 /srv/mediawiki/php-1.43.0-wmf.20/includes/api/ApiMain.php(1948): ApiOpenSearch->execute()
#13 /srv/mediawiki/php-1.43.0-wmf.20/includes/api/ApiMain.php(926): ApiMain->executeAction()
#14 /srv/mediawiki/php-1.43.0-wmf.20/includes/api/ApiMain.php(897): ApiMain->executeActionWithErrorHandling()
#15 /srv/mediawiki/php-1.43.0-wmf.20/includes/api/ApiEntryPoint.php(153): ApiMain->execute()
#16 /srv/mediawiki/php-1.43.0-wmf.20/includes/MediaWikiEntryPoint.php(200): MediaWiki\Api\ApiEntryPoint->execute()
#17 /srv/mediawiki/php-1.43.0-wmf.20/api.php(44): MediaWiki\MediaWikiEntryPoint->run()
#18 /srv/mediawiki/w/api.php(3): require(string)
#19 {main}

Impact

Notes

All similar requests are for action=opensearch, as far as I can tell.

Details

Request URL: https://commons.wikimedia.org/w/api.php?action=opensearch&centralauthtoken=*&format=*&formatversion=*&limit=*&namespace=*&origin=*&search=*

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	CentralAuthApiSessionProvider: Avoid error in internal API requests	mediawiki/extensions/CentralAuth	wmf/1.43.0-wmf.20	+2 -1

Customize query in gerrit

Related Objects
Search...

Status	Subtype	Assigned	Task
Open		None	T345245 Mitigate phase-out of third-party cookies in Wikimedia production
Resolved		Tgr	T345249 Mitigate phase-out of third-party cookies in CentralAuth
Resolved		OWresch-WMF	T348388 SUL3: Use a dedicated domain for login and account creation
Resolved		Tgr	T362713 Implement the new login process which redirects to the central login wiki for showing the login/signup form
Resolved		Tgr	T363699 Determine and implement SUL 3 login handshake mechanism
Resolved	PRODUCTION ERROR	Tgr	T373507 TypeError: Argument 1 passed to MediaWiki\Extension\CentralAuth\CentralAuthTokenManager::consume() must be of the type string, null given

Event Timeline

hashar created this task.Aug 28 2024, 9:02 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 28 2024, 9:02 AM

Caused by rECAUe59ff145fbbb: Use TokenManager for existing token operations.

Tgr claimed this task.Aug 28 2024, 9:11 AM

Tgr added a parent task: T363699: Determine and implement SUL 3 login handshake mechanism.

Tgr moved this task from Inbox, needs triage to In progress (DO NOT USE) on the MediaWiki-Platform-Team board.

hashar mentioned this in T366965: 1.43.0-wmf.20 deployment blockers.Aug 28 2024, 9:27 AM

This seems like a pre-existing bug that became more severe due to stricter type hinting added in that patch. Not sure what exactly is going on - it seems the API sees the centralauthtoken URL parameter at the beginning of the request so it loads the CentralAuth session provider, but then doesn't see the parameter anymore by the point it actually starts processing the request. The first check is via WebRequest::getVal() and the second one via ApiMain::getVal() so it's presumably some sort of discrepancy between those.

Incidentally, rECAUe993c058288d: TokenManager: Get rid of delete() and consume() (on next week's train) will get rid of the code that's causing this error. But it would be nice to understand what's happening.

The stack trace says that PageImages calls the API internally from within an API request. So there will be two WebRequest objects involved, one with a centralauthtoken (the real one) and one without (the internal one). The hook in CentralAuth doesn't handle that (and never did).

This seems a bit noisy, so let's patch wmf.20 to avoid the error (we already removed the code on master).

It would have previously failed with a "Raced out trying to mark the token as expired" log message – you can see that the shapes of these charts match very well:

"Raced out trying to mark the token as expired": https://logstash.wikimedia.org/goto/c4938f9e17e596c28354ef85cf8f14ed
"CentralAuthTokenManager::consume()": https://logstash.wikimedia.org/goto/95dbcbe50afff935ac015a34403cfbc1

So let's just make it fail in the same way.

Change #1068041 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@wmf/1.43.0-wmf.20] CentralAuthApiSessionProvider: Avoid error in internal API requests

https://gerrit.wikimedia.org/r/1068041

gerritbot added a project: Patch-For-Review.Aug 28 2024, 4:19 PM

matmarex renamed this task from TypeError: Argument 1 passed to MediaWiki\Extension\CentralAuth\CentralAuthTokenManager::consume() must be of the type string, null given, called in /srv/mediawiki/php-1.43.0-wmf.20/extensions/CentralAuth/includes/session/Centr to TypeError: Argument 1 passed to MediaWiki\Extension\CentralAuth\CentralAuthTokenManager::consume() must be of the type string, null given.Aug 28 2024, 4:20 PM

So until now any API involving page images broke when used with a CA token? Huh.

The current master should not have that issue, since the internal API call doesn't reinitialize session handlers, and we don't use API hooks anymore which would be double-called.

Change #1068041 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@wmf/1.43.0-wmf.20] CentralAuthApiSessionProvider: Avoid error in internal API requests

https://gerrit.wikimedia.org/r/1068041

Mentioned in SAL (#wikimedia-operations) [2024-08-28T20:37:41Z] <cjming@deploy1003> Started scap sync-world: Backport for [[gerrit:1068051|auth: Relax AuthManager session state check while cde00b55 is deployed (T373504)]], [[gerrit:1068052|Fix missing definition of setSaveErrorMessage too (T373288)]], [[gerrit:1068041|CentralAuthApiSessionProvider: Avoid error in internal API requests (T373507)]]

Stashbot mentioned this in T373288: Show error message when a shortened URL prevents user from adding a topic or comment.Aug 28 2024, 8:37 PM

Stashbot mentioned this in T373504: Wikimedia\NormalizedException\NormalizedException: Authentication failed because of inconsistent provider array.

Mentioned in SAL (#wikimedia-operations) [2024-08-28T20:39:45Z] <cjming@deploy1003> matmarex, cjming: Backport for [[gerrit:1068051|auth: Relax AuthManager session state check while cde00b55 is deployed (T373504)]], [[gerrit:1068052|Fix missing definition of setSaveErrorMessage too (T373288)]], [[gerrit:1068041|CentralAuthApiSessionProvider: Avoid error in internal API requests (T373507)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-08-28T20:49:13Z] <cjming@deploy1003> Finished scap sync-world: Backport for [[gerrit:1068051|auth: Relax AuthManager session state check while cde00b55 is deployed (T373504)]], [[gerrit:1068052|Fix missing definition of setSaveErrorMessage too (T373288)]], [[gerrit:1068041|CentralAuthApiSessionProvider: Avoid error in internal API requests (T373507)]] (duration: 11m 31s)

ReleaseTaggerBot added a project: MW-1.43-notes (1.43.0-wmf.20; 2024-08-27).Aug 28 2024, 9:00 PM

No more errors since the deployment.

Thank you for the patch, that made the logs quieter for this morning MediaWiki Train :)

	F57325965: image.png
	Aug 28 2024, 4:16 PM

	F57325962: image.png
	Aug 28 2024, 4:16 PM

TypeError: Argument 1 passed to MediaWiki\Extension\CentralAuth\CentralAuthTokenManager::consume() must be of the type string, null givenClosed, ResolvedPublicPRODUCTION ERRORActions