Hypothesis

If we change MediaWiki session cookies to a structured format with a cryptographic signature, we will be able to use the presence of a session as a factor in protection against scrapers, by enabling trusted verification of sessions at the edge in a performant and highly scalable manner.

Context

Currently the only way to verify that a session token has been generated by MediaWiki is to ask MediaWiki to validate the session. By making sessions verifiable outside of MediaWiki, we will be able to use the presence of a valid session as a signal in abuse detection at the edge, without adding performance bottlenecks. We can then reuse this same approach to implement MediaWiki authentication in the new API Gateway to enable access to higher rate limits for authenticated users.

Target outcomes

• Edge-verifiable sessions: Session cookies can be efficiently used as a signal in browser-detection at the edge, to help differentiate scrapers from human users.
• API Gateway-verifiable sessions: Session cookies can be efficiently used as an authentication mechanism by the API Gateway to access higher rate limits.
• Minimal reliance on MediaWiki: Session verification can be performed without having to rely on MediaWiki, reducing backend load and improving request performance.
• No changes to user experience: No visible impact to end-users, with seamless migration of existing sessions to the new format.

Success criteria

• New session format that can be verified outside of MediaWiki
• MediaWiki sessions able to be used as an abuse signal at the edge
• No performance regressions in existing use of sessions
• Existing user sessions migrated to new session format
• All user login migrated to use new session format