Summary
It should be possible to inspect the value of http-client-hints during an edit to allow customisable actions (such as preventing the edit from being saved)
Background
- http-client-hints are currently stored for edits post save
- We did not use HTTP headers because these have cache-pollution issues for logged out editors (specifically we cannot unset the Client Hints HTTP headers if a user was to then while logged out edit the edit page to view an article)
- We could not go with pre-save or at-save collection via JS because:
- There are many interfaces that perform edits and we do not have a reliable way to know that an edit has occurred on the front-end until after the edit has been saved (via the 'postEdit' JS hook).
- The infrastructure that stores HTTP Client Hints data in CheckUser needs a reference ID, which for edits is the revision ID of the edit (making pre-save collection impossible)
- Modifying the requests to save edits to include Client Hints data is complicated, partly due to the first point but also as the browser may reject attempts to provide some of the requested Client Hints and/or the browser may not support Client Hints
- There has been a recent need to inspect http-client-hints data to potentially rate-limit or block edits (T401266)
- However, we cannot inspect the value of the Client Hints until after edits are saved
- Other actions (like logging out, creating an account, and in some cases logging in) does collect HTTP Client Hints data using HTTP headers so can be inspected for abuse mitigation
- We can use HTTP headers here because there is a consistent flow where a user loads a page before performing the action (which allows us to set the HTTP headers on the first special page view and then collect the data on the request that submits the form)
- Not all editing interfaces support that flow, and even then we don't necessarily want to imply we are collecting http-client-hints data when a user hasn't even performed an edit yet (which is another reason why a JS approach was also preferred)
- We can use HTTP headers here because there is a consistent flow where a user loads a page before performing the action (which allows us to set the HTTP headers on the first special page view and then collect the data on the request that submits the form)
Technical notes
TBD
Acceptance criteria
- Where possible, http-client-hints data can be inspected during an edit action while allowing this inspection to occur before the edit is saved