[Epic] Improvements to Authentication workflows
Open, MediumPublic
Actions

Assigned To

None

Authored By

	Dbrant
	Jun 9 2025, 6:26 PM

Project Tags

Referenced Files

None

Subscribers

Aklapper

Alex44019

Dbrant

Description

Authentication mechanisms on our platforms continue to evolve, and we need to make adjustments to match that evolution.

Related Objects
Search...

Status	Subtype	Assigned	Task
Resolved		Reedy	T227242 Deploy WebAuthn to Wikimedia Wikis
Open		None	T396400 [Epic] Improvements to Authentication workflows
Open		None	T396394 Create an account screen updates - - Android
Open		None	T396390 Create an account screen updates - iOS
Resolved		Dbrant	T396403 Add support for Captcha when logging in (Android)
Resolved		GOlson-WMF	T396404 Add support for Captcha when logging in (iOS)
Open		None	T230043 Add WebAuthn support to Mobile apps
Open		None	T231242 [Spike] Webauthn support for iOS app
Resolved		None	T248878 [SPIKE] Investigate potential move to Webauthn support
Open		None	T393250 Support WebAuthn second factor login on Wikimedia iOS app
Open		None	T393251 Support WebAuthn second factor login on Wikimedia Android app
Open		ArielGlenn	T395459 Use OAuth rather than password-based login for Wikimedia mobile apps
Resolved		Tgr	T398441 Allow callback URL to be custom app deeplink
Resolved		Tgr	T413286 Support display=popup and preserve authentication flow query parameters for password reset form
Open		Tgr	T413134 Logout API doesn't work with OAuth
Open		Tgr	T208443 User cannot log in with OAuth on a wiki before visiting that wiki directly
Open	BUG REPORT	matmarex	T149672 OAuth: API calls shouldn't fail when the username does not exist locally
Open		Tgr	T412214 Ensure a good experience for apps which want to use OAuth credentials for a long time (refresh token grace period)
Resolved		matmarex	T323867 Clarify use of non-confidential OAuth 2.0 clients
Resolved		matmarex	T323855 OAuth 2.0 non-confidential clients cannot use refresh tokens without client secret
Resolved	BUG REPORT	matmarex	T419034 Custom OAuth 2 error from Wikimedia infrastructure breaks automatic retry of requests
Resolved		daniel	T419130 Exempt some routes from rate limiting and JWT validity checks in the API gateway
Resolved		matmarex	T421778 Action API requests with centralauthtoken=… or OAuth bearer token should produce CORS headers if the token is invalid
Open		None	T413288 Allow managing OAuth apps programmatically
Open		Tgr	T423608 Ensure OAuth flows don’t trigger new user onboarding
Open		None	T423609 Allow skipping OAuth permissions dialog for first party clients
Resolved		Dbrant	T417470 [L] Android Instrumentation for unified Authentication stream on `apps_base`
Resolved		SNowick_WMF	T420797 Android Data Validation for Authorization stream on `apps_base`