Page MenuHomePhabricator
Create Task
Maniphest T414338

[Hypothesis] WE5.4.12: Identify the provenance of image requests (FY25-26)
Closed, ResolvedPublic
Actions

Description

Problem

As part of the work under WE5.4 to protect our infrastructure from abusive scraping, we want to be able to understand the provenance of image requests. This means being able to distinguish when and where a URL to an image was generated.

This will allow us to use this information as a signal in request filtering at the CDN, by helping to determine if a request is coming from a browser session visiting the website, an API query, from dumps or if they are the result of hotlinking.

This intervention was originally proposed in Dec 2025 in Urgent needs for de-risking WE4.3, WE5.4, and our infrastructure (WMF-restricted)

Approach

Generate signed URLs for image requests, by adding query parameters that contain the provenance information and a signature that can be trivially validated at the CDN. The signature should be an HMAC that includes the URL, source (web, api, dumps), timestamp and a secret.

  1. Acceptance criteria
    • Generated image URLs include provence query parameters
    • Generated image URLs include an HMAC signature
    • Signature contents and HMAC algorithm agreed with SRE
    • SRE can configure the CDN based on the source that generated an image URL
    • SRE can configure the CDN based on the freshness of an image URL

Status updates

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
Re-enable wgTrackMediaRequestProvenance on Commons and WikipediaKrinkleoperations/mediawiki-configmaster+0 -32
Re-enable wgTrackMediaRequestProvenance on pilot wikis (group1)Krinkleoperations/mediawiki-configmaster+3 -0
P:cache::haproxy image provenance hashingSlyngshedeoperations/puppetproduction+21 -0
P:cache:haproxy add image generator informationSlyngshedeoperations/puppetproduction+5 -0
Revert "Enable wgTrackMediaRequestProvenance on Commons"Seddonoperations/mediawiki-configmaster+1 -0
Enable wgTrackMediaRequestProvenance on remaining WikipediasKrinkleoperations/mediawiki-configmaster+0 -28
Enable wgTrackMediaRequestProvenance on CommonsKrinkleoperations/mediawiki-configmaster+0 -1
Enable wgTrackMediaRequestProvenance on wikidata.orgKrinkleoperations/mediawiki-configmaster+0 -1
mmv.bootstrap: Avoid double download when thumb is unscaled originalKrinklemediawiki/extensions/MultimediaViewermaster+12 -8
Enable wgTrackMediaRequestProvenance on most group1 wikisKrinkleoperations/mediawiki-configmaster+24 -2
Enable $wgTrackMediaRequestProvenance on group0 wikisKrinkleoperations/mediawiki-configmaster+1 -0
Enable $wgTrackMediaRequestProvenance on testwikis and beta clusterBartosz Dziewońskioperations/mediawiki-configmaster+12 -0
Media: Add provenance parameters to thumbnail and media file URLsBartosz Dziewońskimediawiki/coremaster+114 -5
FileRepo: Rename cache-busting param to '_' on file description pagesBartosz Dziewońskimediawiki/coremaster+1 -1
Media: Generalize cache-busting query params on file description pagesBartosz Dziewońskimediawiki/coremaster+27 -52
Show related patches Customize query in gerrit

Related Objects
Search...

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes
BCornwall subscribed.Apr 13 2026, 4:17 PM
Krinkle added a subtask: T422586: MediaViewer downloads high-res image twice if original is a medium-size JPEG.Apr 20 2026, 5:55 PM
Krinkle created subtask T424082: MediaViewer preview sometimes lacks provenance parameters.Apr 21 2026, 7:10 PM
Krinkle mentioned this in T424082: MediaViewer preview sometimes lacks provenance parameters.
gerritbot added a comment.Apr 22 2026, 12:06 AM

Change #1276086 had a related patch set uploaded (by Krinkle; author: Krinkle):

[mediawiki/extensions/MultimediaViewer@master] mmv.bootstrap: Avoid double download when thumb is unscaled original

https://gerrit.wikimedia.org/r/1276086

Novem_Linguae subscribed.Apr 27 2026, 4:04 PM
gerritbot added a comment.Apr 27 2026, 10:00 PM

Change #1276086 merged by jenkins-bot:

[mediawiki/extensions/MultimediaViewer@master] mmv.bootstrap: Avoid double download when thumb is unscaled original

https://gerrit.wikimedia.org/r/1276086

ReleaseTaggerBot edited projects, added: MW-1.46-notes (1.46.0-wmf.26; 2026-04-28); removed: MW-1.46-notes (1.46.0-wmf.19; 2026-03-10).Apr 27 2026, 11:00 PM
Krinkle closed subtask T422586: MediaViewer downloads high-res image twice if original is a medium-size JPEG as Resolved.Apr 29 2026, 7:59 PM
gerritbot added a comment.May 1 2026, 7:50 PM

Change #1269440 merged by jenkins-bot:

[operations/mediawiki-config@master] Enable wgTrackMediaRequestProvenance on wikidata.org

https://gerrit.wikimedia.org/r/1269440

gerritbot added a comment.May 1 2026, 7:50 PM

Change #1269441 merged by jenkins-bot:

[operations/mediawiki-config@master] Enable wgTrackMediaRequestProvenance on Commons

https://gerrit.wikimedia.org/r/1269441

Stashbot added a comment.May 1 2026, 7:51 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-01T19:51:14Z] <krinkle@deploy1003> Started scap sync-world: Backport for [[gerrit:1269440|Enable wgTrackMediaRequestProvenance on wikidata.org (T414338)]], [[gerrit:1269441|Enable wgTrackMediaRequestProvenance on Commons (T414338)]]

Stashbot added a comment.May 1 2026, 7:52 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-01T19:52:57Z] <krinkle@deploy1003> krinkle: Backport for [[gerrit:1269440|Enable wgTrackMediaRequestProvenance on wikidata.org (T414338)]], [[gerrit:1269441|Enable wgTrackMediaRequestProvenance on Commons (T414338)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Stashbot added a comment.May 1 2026, 8:06 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-01T20:06:42Z] <krinkle@deploy1003> Finished scap sync-world: Backport for [[gerrit:1269440|Enable wgTrackMediaRequestProvenance on wikidata.org (T414338)]], [[gerrit:1269441|Enable wgTrackMediaRequestProvenance on Commons (T414338)]] (duration: 15m 27s)

Mr._Starfleet_Command unsubscribed.May 3 2026, 9:23 PM
RoyZuo subscribed.May 4 2026, 8:58 AM

I think these changes may the the cause behind https://commons.wikimedia.org/wiki/MediaWiki_talk:Gadget-GoogleImagesTineye.js#c-Masur-20251229182900-Reverse_Image_Search_-_Google_and_TinEye_failing_to_retrieve_source_images_from

the gadget's logic is simple. it takes the url of the image and gives it to the search engines in the form of https://lens.google.com/uploadbyurl?url=https%3A%2F%2Fupload.wikimedia.org%2Fwikipedia%2Fcommons%2Fthumb%2Ff%2Ffa%2FStatue_of_Taras_Shevchenko_in_Shevchenkove%252C_Shevchenkove_Raion_2019_by_Venzz_04.jpg%3Futm_source%3Dcommons.wikimedia.org%26utm_campaign%3Dindex%26utm_content%3Doriginal

but as i tested manually, search engines cannot get the image, no matter the link comes with or without the new trackers

utm_source=commons.wikimedia.org&utm_campaign=index&utm_content=original

please explain how to get the gadget working again, i.e. how to get a link of a file that can be read by other websites.

• matmarex added a comment.May 11 2026, 6:09 PM

@RoyZuo A more robust way would be to make the gadget download the image (or a thumbnail), then upload it to the search engine, instead of asking the search engine to fetch it from us, which may be blocked if they don't respect our user-agent policy.

In the meantime, it looks like using a thumbnail URL instead of the original file URL works, at least for now.

Krinkle added a comment.EditedMay 13 2026, 3:37 PM

I've tested everything I wanted to test on Commons and Wikidata.

I expected Wikidata to perhaps not get the provenance params or not work with MMV, but it all looks good. I did find a bug, T426217: MediaViewer downloads high-res image twice if thumb URL is re-used, but that's pre-existing and not caused or made more common by provenance params, and so does not need to block roll-out.

In T414338#11804130, @gerritbot wrote:

Change #1269442 had a related patch set uploaded (by Krinkle; author: Krinkle):

[operations/mediawiki-config@master] Enable wgTrackMediaRequestProvenance on remaining Wikipedias

https://gerrit.wikimedia.org/r/1269442

I've scheduled this for tomorrow afternoon, 13:00 UTC.

gerritbot added a comment.May 14 2026, 1:40 PM

Change #1269442 merged by jenkins-bot:

[operations/mediawiki-config@master] Enable wgTrackMediaRequestProvenance on remaining Wikipedias

https://gerrit.wikimedia.org/r/1269442

Stashbot added a comment.May 14 2026, 1:42 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-14T13:42:53Z] <krinkle@deploy1003> Started scap sync-world: Backport for [[gerrit:1269442|Enable wgTrackMediaRequestProvenance on remaining Wikipedias (T414338)]]

Stashbot added a comment.May 14 2026, 1:44 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-14T13:44:41Z] <krinkle@deploy1003> krinkle: Backport for [[gerrit:1269442|Enable wgTrackMediaRequestProvenance on remaining Wikipedias (T414338)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Stashbot added a comment.May 14 2026, 1:49 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-14T13:49:57Z] <krinkle@deploy1003> Finished scap sync-world: Backport for [[gerrit:1269442|Enable wgTrackMediaRequestProvenance on remaining Wikipedias (T414338)]] (duration: 07m 03s)

Maintenance_bot removed a project: Patch-For-Review.May 14 2026, 2:31 PM
Krinkle added a comment.EditedMay 15 2026, 12:14 PM

Progress update (15 May 2026):

  • SRE now includes media provenance as a signal in calculating the X-Is-Browser score on the edge.
  • Fixed regression in MediaViewer causing high-res double downloads (blocking rollout). T422586
  • Enable media provenance on Wikidata and Wikimedia Commons (720 -> 722/1068 wikis).
  • Did broad manual testing across Wikimedia Commons and Wikidata post-rollout.
  • Found bug in MediaViewer causing lack of provenance params in some cases (pre-existing, not blocking rollout). T424082
  • Found bug in MediaViewer causing low-res double downloads (pre-existing, not blocking rollout). T426217
  • Enable media provenance on remaining 346 Wikipedias, including English Wikipedia. Now live on all 1068 wikis.
Krinkle updated the task description. (Show Details)May 15 2026, 12:14 PM
RoyZuo unsubscribed.May 15 2026, 12:51 PM
MusikAnimal mentioned this in T426373: Mediaviews Analysis returns API not found error.May 15 2026, 6:40 PM
pmiazga subscribed.May 15 2026, 8:47 PM

The update to enable this feature on all wikis has to be reverted due to T425580: [Spike] [BUG] POTD Gallery doesn't load, crashes upon share

AFBorchert subscribed.May 18 2026, 9:43 AM
AFBorchert added a subscriber: RoyZuo.May 18 2026, 9:52 AM

As explained by @RoyZuo above, we have at Wikimedia Commons a serious problem if the gadget that supports image reverse search on Google Lens, TinEye and Yandex doesn't work. Right now, TinEye and Yandex work but Google Lens fails as it is unable to access the images. I am not responsible for the gadget but as one of the admins at Commons I can tell you that this gadget is absolutely essential to fight against copyright violations. We delete about 2000 copyvios every day and we cannot do this efficiently if Google Lens cannot be conveniently queried. Hence, some solution is required such that this gadget can pass URLs that are subsequently not blocked when the respective services download them.

gerritbot added a comment.May 18 2026, 7:21 PM

Change #1288925 had a related patch set uploaded (by Krinkle; author: Seddon):

[operations/mediawiki-config@master] Revert "Enable wgTrackMediaRequestProvenance on Commons"

https://gerrit.wikimedia.org/r/1288925

gerritbot added a project: Patch-For-Review.May 18 2026, 7:21 PM
gerritbot added a comment.May 18 2026, 8:41 PM

Change #1288925 merged by jenkins-bot:

[operations/mediawiki-config@master] Revert "Enable wgTrackMediaRequestProvenance on Commons"

https://gerrit.wikimedia.org/r/1288925

Maintenance_bot removed a project: Patch-For-Review.May 18 2026, 9:31 PM
Stashbot mentioned this in T425580: [Spike] [BUG] POTD Gallery doesn't load, crashes upon share.May 18 2026, 9:31 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-18T21:31:09Z] <krinkle@deploy1003> Started scap sync-world: Backport for [[gerrit:1288925|Revert "Enable wgTrackMediaRequestProvenance on Commons" (T414338 T425580)]]

Stashbot added a comment.May 18 2026, 9:32 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-18T21:32:56Z] <krinkle@deploy1003> seddon, krinkle: Backport for [[gerrit:1288925|Revert "Enable wgTrackMediaRequestProvenance on Commons" (T414338 T425580)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Stashbot added a comment.May 18 2026, 9:42 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-18T21:42:39Z] <krinkle@deploy1003> Finished scap sync-world: Backport for [[gerrit:1288925|Revert "Enable wgTrackMediaRequestProvenance on Commons" (T414338 T425580)]] (duration: 11m 29s)

TheDJ subscribed.May 18 2026, 10:02 PM
In T414338#11885830, @RoyZuo wrote:

I think these changes may the the cause behind https://commons.wikimedia.org/wiki/MediaWiki_talk:Gadget-GoogleImagesTineye.js#c-Masur-20251229182900-Reverse_Image_Search_-_Google_and_TinEye_failing_to_retrieve_source_images_from

but as i tested manually, search engines cannot get the image, no matter the link comes with or without the new trackers

@RoyZuo and @AFBorchert this and the note on VP, implying this has been going on for several weeks, imply that this is very likely NOT caused by this ticket. More likely simply the anti scraping measures of the foundation that have been implemented before have caught these systems as well..

Matmarex has already given advise on how to change the gadget in a way that might make it work more reliable. This can be done right now. Or you can open a separate ticket to investigate why this websites are blocked from accessing us, but it might be that the it is not actually possible to distinguish these systems from illegitimate scrapers. It's hard to say.

RoyZuo unsubscribed.May 19 2026, 10:24 AM

@AFBorchert use browsers like opera, which have "search image with google lens" when you right click on it. probably some extensions for other browsers also do this.
basically the same method described by matmarex: searching the copied image.
but i'm not gonna put my time into making that a gadget on commons.
who broke it should fix it. or who wants to.

AFBorchert added a comment.May 19 2026, 11:54 AM

@TheDJ I am not familiar with the architecture and the algorithms of the protection system against unwanted scraping. To me it appears quite likely that the amount of traffic from a particular site can play a role, causing the tool to work or to fail for some sites. But it appears to me very likely that the gadget failures are linked to the protection system. Regard the gadget: I am not the author of the gadget or anyhow involved in its development. However, downloading and uploading the image to submit them to various reverse searches as suggested by @matmarex do not appear to be the straightforward solution. I think it would be better to be able within the gadget to generate image URLs that are subsequently accepted by protection system. My point is that Wikimedia Commons and its defense against copyright violations is a critical part of the infrastructure. This perspective should be IMHO taken into account when designing and updating the protection system.

OWresch-WMF created subtask Restricted Task.May 29 2026, 12:23 PM
gerritbot added a comment.Jun 1 2026, 1:31 PM

Change #1295921 had a related patch set uploaded (by Slyngshede; author: Slyngshede):

[operations/puppet@production] P:cache:haproxy add image generator information

https://gerrit.wikimedia.org/r/1295921

gerritbot added a project: Patch-For-Review.Jun 1 2026, 1:31 PM
Krinkle updated the task description. (Show Details)Jun 2 2026, 4:29 PM
gerritbot added a comment.Jun 8 2026, 6:22 PM

Change #1295921 merged by BCornwall:

[operations/puppet@production] P:cache:haproxy add image generator information

https://gerrit.wikimedia.org/r/1295921

BCornwall added a subscriber: SLyngshede-WMF.Jun 12 2026, 6:43 PM

@SLyngshede-WMF I'm wondering: Instead of a new header (X-Image-Generator) would it make sense to use the existing X-Provenance header? For example, X-Provenance: imggen=api

gerritbot added a comment.Jun 24 2026, 2:17 PM

Change #1305433 had a related patch set uploaded (by Slyngshede; author: Slyngshede):

[operations/puppet@production] P:cache::haproxy image provenance hashing

https://gerrit.wikimedia.org/r/1305433

gerritbot added a comment.Jul 6 2026, 2:12 PM

Change #1307812 had a related patch set uploaded (by Krinkle; author: Krinkle):

[operations/mediawiki-config@master] Re-enable wgTrackMediaRequestProvenance on pilot wikis (group1)

https://gerrit.wikimedia.org/r/1307812

gerritbot added a comment.Jul 6 2026, 8:06 PM

Change #1307812 merged by jenkins-bot:

[operations/mediawiki-config@master] Re-enable wgTrackMediaRequestProvenance on pilot wikis (group1)

https://gerrit.wikimedia.org/r/1307812

Stashbot mentioned this in T429269: Send logged-in experiment events to ins-502b.Jul 6 2026, 8:06 PM

Mentioned in SAL (#wikimedia-operations) [2026-07-06T20:06:54Z] <krinkle@deploy1003> Started scap sync-world: Backport for [[gerrit:1303490|T429269: Send logged-in experiment events to ins-502b]], [[gerrit:1307812|Re-enable wgTrackMediaRequestProvenance on pilot wikis (group1) (T414338)]]

Stashbot added a comment.Jul 6 2026, 8:08 PM

Mentioned in SAL (#wikimedia-operations) [2026-07-06T20:08:49Z] <krinkle@deploy1003> krinkle, pushpaktiwari: Backport for [[gerrit:1303490|T429269: Send logged-in experiment events to ins-502b]], [[gerrit:1307812|Re-enable wgTrackMediaRequestProvenance on pilot wikis (group1) (T414338)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Stashbot added a comment.Jul 6 2026, 8:15 PM

Mentioned in SAL (#wikimedia-operations) [2026-07-06T20:15:08Z] <krinkle@deploy1003> Finished scap sync-world: Backport for [[gerrit:1303490|T429269: Send logged-in experiment events to ins-502b]], [[gerrit:1307812|Re-enable wgTrackMediaRequestProvenance on pilot wikis (group1) (T414338)]] (duration: 08m 14s)

Krinkle mentioned this in T75935: Support thumb.php request for original-width thumbnail (e.g. HTTP 302 instead of HTTP 400).Jul 28 2026, 3:32 PM
Krinkle closed subtask T424082: MediaViewer preview sometimes lacks provenance parameters as Resolved.
Krinkle claimed this task.EditedJul 31 2026, 11:55 PM
Krinkle closed subtask Restricted Task as Resolved.
Krinkle added subscribers: HNordeenWMF, Seddon, • matmarex.
In T427623#12174799, @HNordeenWMF wrote on Fri 31 July 2026:

No blockers found in the smoke test, @Seddon and I are ok with this scaling now.

Krinkle triaged this task as High priority.Jul 31 2026, 11:57 PM
Krinkle removed projects: Patch-For-Review, MW-1.46-notes (1.46.0-wmf.26; 2026-04-28).
gerritbot added a comment.Aug 1 2026, 1:38 AM

Change #1319903 had a related patch set uploaded (by Krinkle; author: Krinkle):

[operations/mediawiki-config@master] Re-enable wgTrackMediaRequestProvenance on Commons and Wikipedia

https://gerrit.wikimedia.org/r/1319903

gerritbot added a project: Patch-For-Review.Aug 1 2026, 1:38 AM
gerritbot added a comment.Aug 3 2026, 8:07 PM

Change #1319903 merged by jenkins-bot:

[operations/mediawiki-config@master] Re-enable wgTrackMediaRequestProvenance on Commons and Wikipedia

https://gerrit.wikimedia.org/r/1319903

Stashbot added a comment.Aug 3 2026, 8:07 PM

Mentioned in SAL (#wikimedia-operations) [2026-08-03T20:07:40Z] <krinkle@deploy1003> Started scap sync-world: Backport for [[gerrit:1319903|Re-enable wgTrackMediaRequestProvenance on Commons and Wikipedia (T414338)]]

Stashbot added a comment.Aug 3 2026, 8:09 PM

Mentioned in SAL (#wikimedia-operations) [2026-08-03T20:09:29Z] <krinkle@deploy1003> krinkle: Backport for [[gerrit:1319903|Re-enable wgTrackMediaRequestProvenance on Commons and Wikipedia (T414338)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Stashbot added a comment.Aug 3 2026, 8:16 PM

Mentioned in SAL (#wikimedia-operations) [2026-08-03T20:16:06Z] <krinkle@deploy1003> Finished scap sync-world: Backport for [[gerrit:1319903|Re-enable wgTrackMediaRequestProvenance on Commons and Wikipedia (T414338)]] (duration: 08m 26s)

OWresch-WMF subscribed.Aug 7 2026, 12:29 PM

@Krinkle can we consider this work done? Thanks.

OWresch-WMF edited projects, added: [MW-Core] FY2026-27 Q1; removed: MediaWiki-Core-Platform-Team (Kanban).Aug 7 2026, 12:30 PM
OWresch-WMF renamed this task from FY25-26 WE5.4.12: Identify the provenance of image requests to [Hypothesis] WE5.4.12: Identify the provenance of image requests (FY25-26).Aug 7 2026, 12:38 PM
OWresch-WMF moved this task from Backlog to Hypothesis on the [MW-Core] FY2026-27 Q1 board.
Krinkle closed this task as Resolved.Aug 9 2026, 3:23 AM
Bawolff mentioned this in T435283: Varnish cache purges of file assets sometimes seem to be failing, at least sometimes.Aug 25 2026, 2:48 AM
Bawolff subscribed.Aug 25 2026, 2:50 AM

note: based on T435283, it seems likely this broke cache purging of file overwrites on commons.

Krinkle mentioned this in T425216: Varnish serving outdated version at original/non-thumb URL of overwritten file upload.Aug 25 2026, 1:18 PM
AntiCompositeNumber mentioned this in T436505: 400 Bad Request on File:Warsaw Pact in 1990 (orthographic projection).svg.Aug 31 2026, 6:54 PM
TheDJ mentioned this in T437938: PageImages aren't showing in PagePreview for some articles.Wed, Sep 23, 2:56 PM
TheDJ mentioned this in T438923: Media namespace links include utm parameters in the tooltip.
cscott subscribed.Thu, Sep 24, 2:07 PM

Since Content-Platform-Team is trying to deal with the fallout from this (and it looks like PageImages might be affected as well), is the https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1239464 the main patch we need to look at?

Krinkle added a comment.Thu, Sep 24, 5:13 PM

Replied at T438923#12361164.

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits