Cross-wiki API does not work any more
Closed, ResolvedPublicBUG REPORT
Actions

Assigned To

Authored By

	IKhitron
	Sep 3 2024, 6:47 PM

Description

Hi. Today at noon I recognized that every time I refresh the Global Watchlist, I get an internet connection error for test.wikipedia.org. Usually these error message boxes appear for all the the wikis simultaneosly, if there are some internet issues. Looks like it started about at the time of the new MediaWiki version deployment. Now I can see the same problem with mediawiki.org, exactly when Special:Version tells us about today's group 0 deployment. My guess is that tomorrow the same will happen with group 1, and the day after tomorrow with group 2, killing the Global Watchlist, and, more important, stopping the interwiki API completely everywhere.

Open Special:GlobalWatchlist on Meta.
Add testwiki, mediawiki.org, at least one group 1 wiki and at least one group 2 wiki in the settings.
Refresh the watchlist.
Expected: no connection errors.
Got:
- If there wasn't group 1 deployment yet, you can see two error boxes.
- Otherwise there probably be more.

This is what I can see while opening this URL.

Screenshot_20240903_213754_Samsung Internet.png (953×1 px, 537 KB)

There is a chance, of course, that the Global Watchlist was broken in this deployment. But FMHO it's a breaking change in the API parameters, or a bug there. Thank you.

Details

Subject	Repo	Branch	Lines +/-
Do not consume 'centralauthtoken' on api.php OPTIONS requests	mediawiki/extensions/CentralAuth	wmf/1.43.0-wmf.21	+33 -18
Add a test for 'centralauthtoken' handling on OPTIONS requests	mediawiki/extensions/CentralAuth	master	+20 -0
Do not consume 'centralauthtoken' on api.php OPTIONS requests	mediawiki/extensions/CentralAuth	master	+33 -18

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved	Release	dancy	T373640 1.43.0-wmf.21 deployment blockers
		Resolved	BUG REPORT	matmarex	T373925 Cross-wiki API does not work any more

Event Timeline

IKhitron created this task.Sep 3 2024, 6:47 PM

Restricted Application added a project: User-DannyS712. · View Herald TranscriptSep 3 2024, 6:47 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

UPD. There is only testwiki again. Special:Version on Mediawiki:org shows a rollback.

(See https://versions.toolforge.org/ for a versions overview and T373640: 1.43.0-wmf.21 deployment blockers for this week's deployment train status.)

The cross-wiki request to test.wikipedia.org is failing with code: "badtoken", info: "The centralauthtoken is not valid.":

I would guess that the token is consumed by the OPTIONS request, and thus invalid in the GET request, when it wasn't happening before.

Could be caused by https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CentralAuth/+/1055945.

Restricted Application added a project: MediaWiki-Platform-Team. · View Herald TranscriptSep 4 2024, 12:40 PM

matmarex added a parent task: T373640: 1.43.0-wmf.21 deployment blockers.Sep 4 2024, 12:40 PM

Train blocker -> UBN! status.

IKhitron updated the task description. (Show Details)Sep 4 2024, 12:48 PM

I will make OPTIONS requests not consume the token again. This is how it worked before, but in a complicated way, and we changed it without understanding what it does. We were consuming the token in a dynamically registered ApiCheckCanExecute hook handler, which is not called for OPTIONS requests (see code here: https://gerrit.wikimedia.org/g/mediawiki/core/+/2a9b9675e20bb67d30df015bca43508a18929bbb/includes/api/ApiMain.php#912 which exits before calling $this->executeAction() → $this->checkExecutePermissions( $module ) → $this->getHookRunner()->onApiCheckCanExecute( $module, $user, $message )).

matmarex renamed this task from Interwiki API does not work any more to Cross-wiki API does not work any more.Sep 4 2024, 1:22 PM

DAlangi_WMF moved this task from Inbox, needs triage to Current Sprint on the MediaWiki-Platform-Team board.Sep 4 2024, 1:46 PM

Change #1070609 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@master] Do not consume 'centralauthtoken' on api.php OPTIONS requests

https://gerrit.wikimedia.org/r/1070609

gerritbot added a project: Patch-For-Review.Sep 4 2024, 2:15 PM

To run into this problem, the api.php requests must do something to require preflight requests (e.g. set a custom HTTP header; GlobalWatchlist sets a User-Agent header, following the best practices), and the user has to do something to require the 'centralauthtoken' to be used in ForeignApi requests (e.g. disallow third-party cookies in your browser, or be logged out on the target wiki, in this case test.wikipedia.org), and you have to configure Special:GlobalWatchlistSettings to add test.wikipedia.org to the site list.

This explains why other people had a hard time reproducing your bug report, and it's a bit lucky that I reproduced it immediately; I don't even remember when I configured GlobalWatchlist that way, I must have done it when investigating some different cross-wiki bug a long time ago.

Minimal code to reproduce the problem outside of GlobalWatchlist:

api = new mw.ForeignApi( 'https://test.wikipedia.org/w/api.php',{
	ajax: {
		headers: {
			'Api-User-Agent': 'testing T373925'
		}
	}
} );
api.foreignLoginPromise = $.Deferred().reject(); // to force use of 'centralauthtoken'
await api.get( { meta: 'userinfo' } );

hashar mentioned this in T373640: 1.43.0-wmf.21 deployment blockers.Sep 4 2024, 3:08 PM

Agusbou2015 subscribed.Sep 4 2024, 3:23 PM

Change #1070609 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Do not consume 'centralauthtoken' on api.php OPTIONS requests

https://gerrit.wikimedia.org/r/1070609

Change #1070638 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@wmf/1.43.0-wmf.21] Do not consume 'centralauthtoken' on api.php OPTIONS requests

https://gerrit.wikimedia.org/r/1070638

Change #1070638 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@wmf/1.43.0-wmf.21] Do not consume 'centralauthtoken' on api.php OPTIONS requests

https://gerrit.wikimedia.org/r/1070638

Mentioned in SAL (#wikimedia-operations) [2024-09-04T16:37:57Z] <dancy@deploy1003> Started scap sync-world: Backport for [[gerrit:1070638|Do not consume 'centralauthtoken' on api.php OPTIONS requests (T373925)]]

Mentioned in SAL (#wikimedia-operations) [2024-09-04T16:40:04Z] <dancy@deploy1003> matmarex, dancy: Backport for [[gerrit:1070638|Do not consume 'centralauthtoken' on api.php OPTIONS requests (T373925)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-09-04T16:48:13Z] <dancy@deploy1003> Finished scap sync-world: Backport for [[gerrit:1070638|Do not consume 'centralauthtoken' on api.php OPTIONS requests (T373925)]] (duration: 10m 16s)