Move CentralAuth hooks out of MobileFrontend into CentralAuth
Open, LowPublic
Actions

Assigned To

None

Authored By

	Jdlrobson-WMF
	May 12 2025, 10:16 PM

Project Tags

Referenced Files

	F59919834: Screen_Recording_20250512_151509_Chrome.mp4
	May 12 2025, 10:19 PM

Subscribers

Description

Background

The MobileFrontend extension makes use of the CentralAuthLoginRedirectData and CentralAuthSilentLoginRedirect hooks to handle logins from a mobile domain. This code currently lives inside the MobileFrontend codebase and presumably is not maintained as well as it should. When bugs exist, it means users are unable to login. Currently for example, on office wiki, logging in results in a BadTitle (may or may not be related)

Given the work in T214998 it is likely that this code may need refinement so it is proposed that in preparation for that work, this code is moved into CentralAuth where it can be adjusted.

User story

As a developer I want all CentralAuth code consolidated in the same place and maintained by people who understand the implications of change to it.

Requirements

Code is ported to CentralAuth
Hooks are removed from MobileFrontend (https://codesearch.wmcloud.org/search/?q=CentralAuthLoginRedirectData&files=&excludeFiles=&repos=Extension%3AMobileFrontend returns no results)

BDD

For QA engineer to fill out

Test Steps

For QA engineer to fill out

Design

Add mockups and design requirements

Acceptance criteria

Add acceptance criteria

Communication criteria - does this need an announcement or discussion?

Add communication criteria

Rollback plan

What is the rollback plan in production for this task if something goes wrong?

This task was created by Version 1.2.0 of the Web team task template using phabulous

Related Objects

Mentioned Here: T195494: Handle mobile domains in core
T214998: RFC: Serve mobile and desktop variants through the same URL (unified mobile routing)

Event Timeline

Jdlrobson-WMF created this task.May 12 2025, 10:16 PM

Restricted Application added a project: MediaWiki-Core-Platform-Team. · View Herald TranscriptMay 12 2025, 10:16 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Jdlrobson-WMF added a parent task: T214998: RFC: Serve mobile and desktop variants through the same URL (unified mobile routing).May 12 2025, 10:17 PM

Not sure if this login bug relates to this code but sharing why I am so apprehensive about it being where it is.

Visiting https://office.wikimedia.org/wiki/Homepage (as an anonymous user) and (hovering or) clicking on "Mobile view" at the bottom of the page (to switch to mobile view), results in me landing on a Special:Badtitle page.

So hitting the Bad title page may not be related to authentication I think? Do you have the same experience as I have?

After having the mobile view, I go back to the home page and click login and login successfully (then redirect back to home). So it seems the special bad page is happening even before the login via a returnto parameter I think.

Yes looks like it. (Although I got a session hijacking warning this time so I suspect there are other bugs in this code).

Anyway I think moving this code is a good starting point to understand these issues better.

Not really a subtask of T214998: RFC: Serve mobile and desktop variants through the same URL (unified mobile routing) - if that happened, these hooks wouldn't be necessary at all.

If we put some effort into improving the mobile domain logic (as things stand in WMF bureaucracy today, I think the work request for that would have to come from another team), I'd rather see that go towards T195494: Handle mobile domains in core.