Currently the time a re-authentication is valid for (ReauthenticateTime) is 60 seconds (1 minute) for 2FA operations (set in OATHAuth) and 300 seconds (5 minutes) for other operations in MW core (like changing one's password). We want to increase both to 3600 seconds (1 hour). This means changing the default in MW core and dropping the oath-specific override in OATHAuth.
Description
Description
Details
Details
Related Changes in Gerrit:
Customize query in gerrit
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Mstyles | T402094 Require reauth for all visits to and actions on Special:OATHManage | |||
| Resolved | Mstyles | T402037 Increase ReauthenticateTime to 1 hour |
Event Timeline
Comment Actions
Change #1180261 had a related patch set uploaded (by Mstyles; author: Mstyles):
[mediawiki/core@master] config: Change Reauthenticate Time Default
Comment Actions
There was another gerrit patch that was merged - https://phabricator.wikimedia.org/T402094#11103212 that was actually meant for this ticket
Comment Actions
Change #1180261 merged by jenkins-bot:
[mediawiki/core@master] config: Change Reauthenticate Time Default
Comment Actions
Change #1180661 had a related patch set uploaded (by Reedy; author: Mstyles):
[mediawiki/core@REL1_44] config: Change Reauthenticate Time Default
Comment Actions
Change #1180662 had a related patch set uploaded (by Reedy; author: Mstyles):
[mediawiki/core@REL1_43] config: Change Reauthenticate Time Default
Comment Actions
Change #1180663 had a related patch set uploaded (by Reedy; author: Mstyles):
[mediawiki/core@REL1_39] config: Change Reauthenticate Time Default
Comment Actions
Change #1180663 merged by jenkins-bot:
[mediawiki/core@REL1_39] config: Change Reauthenticate Time Default
Comment Actions
Change #1180662 merged by jenkins-bot:
[mediawiki/core@REL1_43] config: Change Reauthenticate Time Default
Comment Actions
Change #1180661 merged by jenkins-bot:
[mediawiki/core@REL1_44] config: Change Reauthenticate Time Default
Comment Actions
If we are backporting the core change, maybe there should be an email about it? It's a UX improvement but it's also a significant change in a key security feature, so I think site admins should get some sort of warning.