Page MenuHomePhabricator

hCaptcha: Enable version pinning and subresource integrity
Closed, ResolvedPublic

Description

Summary

hCaptcha's secure enclave mode supports pinning a specific version of the secure-api.js script, for which we can also use subresource integrity for verification.

Background

T403829: hCaptcha: Self-host secure-api.js code needs more time to work out how to accommodate loading the secure-api.js in ConfirmEdit and on Wikimedia hosting. In the meantime, we'll benefit from pinning the version of the secure-api.js script and ensuring that it's contents do not change from our expectations by setting the integrity parameter on the script element.

Acceptance criteria

  • ConfirmEdit/hCaptcha supports specifying the integrity field for the script element of the secure-api.js script
  • Wikimedia's deployment of hCaptcha has veresion pinning and subresource integrity enabled for secure-api.js

Event Timeline

Change #1187073 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/ConfirmEdit@master] hCaptcha: Allow usage of subresource integrity

https://gerrit.wikimedia.org/r/1187073

Change #1187079 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[operations/mediawiki-config@master] hCaptcha: Set wgHCaptchaApiUrlIntegrityHash and pin secure-api.js version

https://gerrit.wikimedia.org/r/1187079

Change #1187439 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[operations/puppet@production] hCaptcha: Special handling for hcaptcha-secure-api.js requests

https://gerrit.wikimedia.org/r/1187439

kostajh added a parent task: Restricted Task.Sep 11 2025, 6:23 PM

Change #1188380 had a related patch set uploaded (by Effie Mouzeli; author: Effie Mouzeli):

[operations/puppet@production] P:hcaptcha: add temporary redirect

https://gerrit.wikimedia.org/r/1188380

Change #1188380 merged by Effie Mouzeli:

[operations/puppet@production] P:hcaptcha: add temporary redirect

https://gerrit.wikimedia.org/r/1188380

Change #1188750 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[operations/puppet@production] P:hcaptcha: Adjust regex match

https://gerrit.wikimedia.org/r/1188750

Change #1187439 abandoned by Kosta Harlan:

[operations/puppet@production] hCaptcha: Special handling for hcaptcha-secure-api.js requests

Reason:

Done via Ida1fa98e0cf8aee2922edc2186a423c02bd3246f

https://gerrit.wikimedia.org/r/1187439

Change #1188750 merged by Effie Mouzeli:

[operations/puppet@production] P:hcaptcha: Adjust regex match

https://gerrit.wikimedia.org/r/1188750

Change #1188823 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/ConfirmEdit@wmf/1.45.0-wmf.18] hCaptcha: Enable version pinning and subresource integrity

https://gerrit.wikimedia.org/r/1188823

Change #1188824 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/ConfirmEdit@wmf/1.45.0-wmf.19] hCaptcha: Enable version pinning and subresource integrity

https://gerrit.wikimedia.org/r/1188824

Change #1187073 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] hCaptcha: Enable version pinning and subresource integrity

https://gerrit.wikimedia.org/r/1187073

Change #1188823 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@wmf/1.45.0-wmf.18] hCaptcha: Enable version pinning and subresource integrity

https://gerrit.wikimedia.org/r/1188823

Change #1188824 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@wmf/1.45.0-wmf.19] hCaptcha: Enable version pinning and subresource integrity

https://gerrit.wikimedia.org/r/1188824

Mentioned in SAL (#wikimedia-operations) [2025-09-16T20:36:32Z] <kharlan@deploy1003> Started scap sync-world: Backport for [[gerrit:1188823|hCaptcha: Enable version pinning and subresource integrity (T404251)]], [[gerrit:1188824|hCaptcha: Enable version pinning and subresource integrity (T404251)]]

Mentioned in SAL (#wikimedia-operations) [2025-09-16T20:42:29Z] <kharlan@deploy1003> kharlan: Backport for [[gerrit:1188823|hCaptcha: Enable version pinning and subresource integrity (T404251)]], [[gerrit:1188824|hCaptcha: Enable version pinning and subresource integrity (T404251)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2025-09-16T20:49:03Z] <kharlan@deploy1003> Finished scap sync-world: Backport for [[gerrit:1188823|hCaptcha: Enable version pinning and subresource integrity (T404251)]], [[gerrit:1188824|hCaptcha: Enable version pinning and subresource integrity (T404251)]] (duration: 12m 31s)

Change #1187079 merged by jenkins-bot:

[operations/mediawiki-config@master] hCaptcha: Set wgHCaptchaApiUrlIntegrityHash and pin secure-api.js version

https://gerrit.wikimedia.org/r/1187079

Mentioned in SAL (#wikimedia-operations) [2025-09-16T20:52:52Z] <kharlan@deploy1003> Started scap sync-world: Backport for [[gerrit:1187079|hCaptcha: Set wgHCaptchaApiUrlIntegrityHash and pin secure-api.js version (T404251)]]

Mentioned in SAL (#wikimedia-operations) [2025-09-16T20:58:45Z] <kharlan@deploy1003> kharlan: Backport for [[gerrit:1187079|hCaptcha: Set wgHCaptchaApiUrlIntegrityHash and pin secure-api.js version (T404251)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2025-09-16T21:06:35Z] <kharlan@deploy1003> Finished scap sync-world: Backport for [[gerrit:1187079|hCaptcha: Set wgHCaptchaApiUrlIntegrityHash and pin secure-api.js version (T404251)]] (duration: 13m 42s)