Create a MW REST API endpoint for fetching CSRF tokens
Open, Needs TriagePublic3 Estimated Story Points
Actions

Assigned To

None

Authored By

	HCoplin-WMF
	Apr 18 2025, 2:45 AM

Description

CSRF tokens are required for making calls within the sandbox, as they are executed by the browser on behalf of users.

Create a new endpoint that allows the user to request a token from within the MW REST API.
Endpoint is surfaced within the MW REST API as a vBeta endpoint for testing purposes.
- Route: GET rest.php/vBeta/tokens/csrf --> Route naming up for debate/input -- we may release other types of developer tokens/authentication mechanisms, such as a developer JWT and/or OAuth workflows.
Returns a token that can then be used within additional REST request bodies.

Action API endpoint for fetching CSRF tokens: https://www.mediawiki.org/wiki/API:Tokens

		Status	Subtype	Assigned	Task
		Open		None	T402455 [REST Sandbox] Improve OpenAPI spec generation & Sandbox experience for MediaWiki REST APIs
		Open		None	T392278 Create a MW REST API endpoint for fetching CSRF tokens

HCoplin-WMF updated the task description. (Show Details)

Minor detail: we changed our convention from "vBeta" (which never reached production) to "-beta" suffixes. See T395713: REST: Beta Modules - support beta suffix in module ids and versions. All that changes is the experimental route at which the proposed endpoint is exposed.

Notes from Estimation:

Create a new module for authentication/token handling, where this is the first endpoint. (noting that CSRF is not actually auth, so we should chat about what to name said module. Maybe 'Access'?)
Future enhancements may also surface OAuth token handling more elegantly.
Implementation notes:
- Recommend doing an investigation of what the actual behavior is within the Action API; consider if we should rebuild/replicate that in MW REST independently of the Action API, with a consideration for the risk of divergence in behavior.
- We can directly wrap the Action API endpoint. There is an existing pattern and handler for wrapping Action API endpoints, so it is not new, but perhaps less than ideal.

HCoplin-WMF set the point value for this task to 3.Nov 13 2025, 4:53 PM