Make hCaptcha proxy URL compatible with MediaWiki CSP
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	• acooper
	Mar 14 2025, 4:11 PM

Project Tags

Referenced Files

None

Subscribers

• acooper

Aklapper

Description

This is to avoid reporting of many errors on the CSP audit logs, but it should still work anyway

Details

Related Changes in Gerrit:

Subject	Repo	Branch	Lines +/-
HCaptcha: Fix getCSPUrls()	mediawiki/extensions/ConfirmEdit	REL1_44	+1 -1
hCaptcha: Variable-ise CSP URLs	mediawiki/extensions/ConfirmEdit	REL1_44	+8 -1
HCaptcha: Fix getCSPUrls()	mediawiki/extensions/ConfirmEdit	master	+1 -1
hCaptcha: Variable-ise CSP URLs	mediawiki/extensions/ConfirmEdit	master	+8 -1
hCaptcha: Add config to disable loading of hCaptcha CSP rules	mediawiki/extensions/ConfirmEdit	master	+8 -0

Customize query in gerrit

Related Objects

Mentioned In: T423039: [hCaptcha] CORS error on jawiki/enwiki Special:CreateAccount (fails to load secure-api.js), but works on mediawikiwiki

Event Timeline

• acooper created this task.Mar 14 2025, 4:11 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 14 2025, 4:11 PM

Probably a config flag as to whether to set CSP headers.

And/or a $wg of values to be set, to allow them to be customised...

Reedy moved this task from Backlog to In progress on the Bot detection and mitigation (WE4.2 hCaptcha account creation trial) board.Apr 14 2025, 11:19 AM

Change #1136349 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/ConfirmEdit@master] hCaptcha: Add config to disable loading of hCaptcha CSP rules

https://gerrit.wikimedia.org/r/1136349

gerritbot added a project: Patch-For-Review.Apr 14 2025, 11:20 AM

^ Patch stops the adding of hcaptcha.com and *.hcaptcha.com to requests.

TBC if we need to add custom CSP rules for our proxy (maybe? maybe not). We may need/want to move the hard coded [ 'https://hcaptcha.com', 'https://*.hcaptcha.com' ] into a $wg to allow customisation too...

	/** @inheritDoc */
	public static function getCSPUrls() {
		return [ 'https://hcaptcha.com', 'https://*.hcaptcha.com' ];
	}

	/**
	 * Adds the CSP policies that are necessary for the captcha module to work in a CSP enforced
	 * setup.
	 *
	 * @param ContentSecurityPolicy $csp The CSP instance to add the policies to, this is usually to be
	 * obtained from {@link OutputPage::getCSP()}
	 */
	public static function addCSPSources( ContentSecurityPolicy $csp ) {
		foreach ( static::getCSPUrls() as $src ) {
			// Since frame-src is not supported
			$csp->addDefaultSrc( $src );
			$csp->addScriptSrc( $src );
			$csp->addStyleSrc( $src );
		}
	}