Page MenuHomePhabricator

Consider removing edge login and subresource autologin in the future
Open, Needs TriagePublic

Description

(this is a placeholder for discussion in far future)

CentralAuth's edge login and subresource autologin are two of the mechanisms it uses to try to log you into all of the wikis when you log in just once. They do not work in browsers that block third-party cookies, and the user experience of being automatically logged in is unlike any other SSO system I've ever seen, and probably unlike the SSO systems our users are familiar with.

For these reasons I wish that we would remove them at some point after third-party cookie blocking becomes common.

However, we have promised things like "Special:UserLogin now logs the user in to every unified wiki simultaneously" for a very long time, so this isn't a decision we can make lightly, and it would come as a surprise to users whose browsers continue to allow third-party cookies (or who allow them themselves).

It would be a lot of effort to document the trade-offs, so I'm not going to do that right now, but it should be done one day.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

They do not work in browsers that block third-party cookies

I don't think this is entirely true. The idea behind SUL3 is to ensure there is user interaction on the central domain, which whitelists that domain for third-party cookie access (in theory - we haven't done much testing of this). The problem is that logins last for a long time and the effect of user interactions do not last forever, so on cookie-blocking browsers (which is currently a minority, but that might change) we'd probably need a way to repeat that interaction, even though the user does not need to log in. That would be T369467: SUL3: Consider adding interstitial when the user is already logged in centrally.

Without edge login and subresource autologin, account autocreation would require an intentional action from the user. That would solve some problems (see e.g. T21161: Don't autologin if local account doesn't exist (don't autocreate if user doesn't explicitly login)), at the cost of ease of use for cross-wiki work.