Page MenuHomePhabricator
Create Task
Maniphest T418957

Add client-side logging for non-MediaWiki action API errors (HTTP 429)
Closed, ResolvedPublic
Actions

Description

When a MediaWiki action API request fails because of an error on the MediaWiki side, we have PHP error logging that allows people to be alerted and debug the error. When it fails for some other reason, the situation is more murky.

In particular, in order to be able to know whether normal users of web browsers are affected by the new API rate limits (as opposed to the scrapers that the limits are intended for), and to have some idea about which components are making too many API requests, we should log it on the client side when an action API request fails with a HTTP 429 error.

Details

Related Changes in Gerrit:
SubjectRepoBranchLines +/-
mw.Api: Client-side logging for HTTP 429 errorsmediawiki/coremaster+66 -1
Configure $wgApiClientErrorSampleRateoperations/mediawiki-configmaster+9 -0
Customize query in gerrit

Related Objects
Search...

Event Timeline

matmarex created this task.Mar 3 2026, 11:13 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 3 2026, 11:13 PM
gerritbot added a comment.Mar 3 2026, 11:37 PM

Change #1247702 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/core@master] mw.Api: Client-side logging for HTTP 429 errors

https://gerrit.wikimedia.org/r/1247702

gerritbot added a project: Patch-For-Review.Mar 3 2026, 11:37 PM
matmarex mentioned this in T418969: Rate limiting gateway should allow cross-origin requests from web browsers to read the HTTP 429 response.Mar 4 2026, 1:57 AM
matmarex added a subtask: T418969: Rate limiting gateway should allow cross-origin requests from web browsers to read the HTTP 429 response.
Seddon subscribed.Mar 4 2026, 3:22 AM
AGhirelli-WMF moved this task from Incoming (Needs Triage) to Radar (other teams work) on the MW-Interfaces-Team board.Mar 4 2026, 2:08 PM
daniel added a parent task: T417779: rest gateway: enforce rate limits (stage two).Mar 4 2026, 3:08 PM
Tgr added subscribers: daniel, Tgr.Mar 5 2026, 2:49 PM

@daniel pointed out that the error logging endpoint needs to be exempt from rate limits for this to work.

Tgr added a subtask: T419130: Exempt some routes from rate limiting and JWT validity checks in the API gateway.Mar 5 2026, 2:49 PM
MShilova_WMF subscribed.Mar 5 2026, 7:09 PM
Krinkle moved this task from Inbox, needs triage to Kanban Board on the MediaWiki-Platform-Team board.Mar 10 2026, 3:52 PM
Krinkle edited projects, added MediaWiki-Platform-Team (Kanban Board); removed MediaWiki-Platform-Team.
Krinkle moved this task from Essential Work to OKR Work on the MediaWiki-Platform-Team (Kanban Board) board.
daniel mentioned this in T219857: massviews hits 429 Too Many Requests despite making requests synchronously.Mar 16 2026, 3:40 PM
matmarex claimed this task.Mar 16 2026, 6:01 PM
matmarex moved this task from OKR Work to In Progress on the MediaWiki-Platform-Team (Kanban Board) board.
gerritbot added a comment.Mar 16 2026, 7:33 PM

Change #1253626 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[operations/mediawiki-config@master] Configure $wgApiClientErrorSampleRate

https://gerrit.wikimedia.org/r/1253626

gerritbot added a comment.Mar 16 2026, 8:55 PM

Change #1253626 merged by jenkins-bot:

[operations/mediawiki-config@master] Configure $wgApiClientErrorSampleRate

https://gerrit.wikimedia.org/r/1253626

Stashbot mentioned this in T414338: FY25-26 WE5.4.12: Identify the provenance of image requests.Mar 16 2026, 8:57 PM
Stashbot mentioned this in T417278: Choosing client credentials grant for OAuth 2 results in an access token (JWT) with the 'sub' field empty.
Stashbot mentioned this in T419921: TypeError: MediaWiki\Extension\OAuth\ResourceServer::getUser(): Return value must be of type MediaWiki\User\User, false returned.

Mentioned in SAL (#wikimedia-operations) [2026-03-16T20:57:26Z] <catrope@deploy2002> Started scap sync-world: Backport for [[gerrit:1253623|Fix client credentials access tokens (T417278 T419921)]], [[gerrit:1253625|Enable $wgTrackMediaRequestProvenance on testwikis and beta cluster (T414338)]], [[gerrit:1253626|Configure $wgApiClientErrorSampleRate (T418957)]]

Stashbot added a comment.Mar 16 2026, 8:59 PM

Mentioned in SAL (#wikimedia-operations) [2026-03-16T20:59:17Z] <catrope@deploy2002> matmarex, catrope: Backport for [[gerrit:1253623|Fix client credentials access tokens (T417278 T419921)]], [[gerrit:1253625|Enable $wgTrackMediaRequestProvenance on testwikis and beta cluster (T414338)]], [[gerrit:1253626|Configure $wgApiClientErrorSampleRate (T418957)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Stashbot added a comment.Mar 16 2026, 9:05 PM

Mentioned in SAL (#wikimedia-operations) [2026-03-16T21:05:37Z] <catrope@deploy2002> Finished scap sync-world: Backport for [[gerrit:1253623|Fix client credentials access tokens (T417278 T419921)]], [[gerrit:1253625|Enable $wgTrackMediaRequestProvenance on testwikis and beta cluster (T414338)]], [[gerrit:1253626|Configure $wgApiClientErrorSampleRate (T418957)]] (duration: 08m 06s)

matmarex mentioned this in T420280: Authenticated cross-origin requests are being throttled as if unauthenticated (centralauth).Mar 18 2026, 9:30 PM
gerritbot added a comment.Mar 20 2026, 9:21 AM

Change #1247702 merged by jenkins-bot:

[mediawiki/core@master] mw.Api: Client-side logging for HTTP 429 errors

https://gerrit.wikimedia.org/r/1247702

Maintenance_bot removed a project: Patch-For-Review.Mar 20 2026, 9:30 AM
ReleaseTaggerBot added a project: MW-1.46-notes (1.46.0-wmf.21; 2026-03-24).Mar 20 2026, 10:00 AM
daniel added a comment.Mar 20 2026, 1:43 PM
In T418957#11677737, @Tgr wrote:

@daniel pointed out that the error logging endpoint needs to be exempt from rate limits for this to work.

Turns out the event logging endpoint is not behind the api gateway, so this point is moot.

daniel closed this task as Resolved.Mar 20 2026, 1:44 PM

patch merged, will ride the train next week

daniel closed subtask T418969: Rate limiting gateway should allow cross-origin requests from web browsers to read the HTTP 429 response as Resolved.Apr 1 2026, 4:40 PM
daniel closed subtask T419130: Exempt some routes from rate limiting and JWT validity checks in the API gateway as Resolved.Apr 15 2026, 8:37 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits