In order to support better error messages (T418953) and error logging (T418957) in components that make cross-origin requests, such as https://meta.wikimedia.org/wiki/Special:GlobalWatchlist, the rate limiting gateway must allow cross-origin requests from web browsers to read the HTTP 429 response.
In practice, I think we'll need the following, although maybe this plan can be improved:
- HTTP OPTIONS requests must not be subject to rate limits, in order to allow the preflight request to reach MediaWiki (which will validate the origin and return appropriate response to allow or disallow the request), so that the browser may allow the real request that will return a 429 to go through
- (I think trying to implement the preflight logic correctly in the gateway would be too much)
- HTTP GET/POST responses generated by the gateway should include the following headers:
- Access-Control-Allow-Credentials: true
- Access-Control-Allow-Origin: the value of the Origin header
- (while validating the origin is necessary to avoid leaking information to external websites, I think it is sufficient if the preflight request does it, and we can just return it without checking here – this means that allowing the preflight request to reach MediaWiki is critical to validate the origin and avoid information leaks)
- Access-Control-Expose-Headers: Retry-After
If this is too complex to do, then we should decline this, with the knowledge that we won't have correct error messages and error logging for cross-wiki API requests from web browsers when the rate limits are exceeded.