T418507: Move wmfGetPrivilegedGroups(), $wmgPrivilegedGroups, $wmgPrivilegedGlobalGroups, GetSecurityLogContext and PasswordPoliciesForUser hook handlers to WikimediaCustomizations would create a PrivilegedGroups component in WikimediaCustomizations, that might be a good (temporary) place for the code.

One thing that could be improved: currently the script checks Title::isSiteJsConfigPage() but not $wgRawHtmlMessages (compare with PermissionManager::checkSiteConfigPermissions()).

(See also {T419768} and {T419769} for improving that from the other end.)

Idea from @EMill-WMF: add the ability to require WebAuthn-only reauth (no TOTP or recovery codes) for certain rights+groups. For example, staff users should not be able to use TOTP/recovery codes to reauth for sensitive actions (but they should still be able to reauth for 2FA CRUD that way).

Since same question in T197160 might be ignored, what's the timeline for making re-auth less painful to deal with? It's been 2 weeks since your self-inflicted petard hoisting incident. This actively prevents people from making well-intentioned edits.

@stjn: How is moving code (the scope of this task) related to your question which comes across as passive-aggressive to me?

Change #1266329 had a related patch set uploaded (by Mstyles; author: Mstyles):

[mediawiki/extensions/WikimediaCustomizations@master] Force Reauth

https://gerrit.wikimedia.org/r/1266329

Deployment plan (from @sbassett)

1. Patch gets reviewed and +2
2. Merge your patch to master (wouldn't be cut until next week)
3. Pick the patch to .24 by one of this Thursday's backport windows
4. Schedule this deployment
5. Make the change to PS.php just before the deployment
6. We run a sync-world to deploy your patch and the PS.php change

Change #1271886 had a related patch set uploaded (by Mstyles; author: Mstyles):

[mediawiki/extensions/WikimediaCustomizations@wmf/1.46.0-wmf.24] Force Reauth

https://gerrit.wikimedia.org/r/1271886

Change #1271886 merged by jenkins-bot:

[mediawiki/extensions/WikimediaCustomizations@wmf/1.46.0-wmf.24] Force Reauth

https://gerrit.wikimedia.org/r/1271886

Change #1266329 merged by jenkins-bot:

[mediawiki/extensions/WikimediaCustomizations@master] Force Reauth

https://gerrit.wikimedia.org/r/1266329

Mentioned in SAL (#wikimedia-operations) [2026-04-15T20:23:10Z] <mstyles@deploy1003> Started scap sync-world: Backport for [[gerrit:1271886|Force Reauth (T419621)]], [[gerrit:1271830|Rename Test Kitchen Experiment (T420007)]], [[gerrit:1271831|Rename Test Kitchen Experiment (T420007)]], [[gerrit:1271833|Rename Test Kitchen Experiment (T420007)]], [[gerrit:1271832|Rename Test Kitchen Experiment (T420007)]]

Mentioned in SAL (#wikimedia-operations) [2026-04-15T20:25:04Z] <mstyles@deploy1003> mstyles: Backport for [[gerrit:1271886|Force Reauth (T419621)]], [[gerrit:1271830|Rename Test Kitchen Experiment (T420007)]], [[gerrit:1271831|Rename Test Kitchen Experiment (T420007)]], [[gerrit:1271833|Rename Test Kitchen Experiment (T420007)]], [[gerrit:1271832|Rename Test Kitchen Experiment (T420007)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now

Mentioned in SAL (#wikimedia-operations) [2026-04-15T20:30:58Z] <mstyles@deploy1003> Finished scap sync-world: Backport for [[gerrit:1271886|Force Reauth (T419621)]], [[gerrit:1271830|Rename Test Kitchen Experiment (T420007)]], [[gerrit:1271831|Rename Test Kitchen Experiment (T420007)]], [[gerrit:1271833|Rename Test Kitchen Experiment (T420007)]], [[gerrit:1271832|Rename Test Kitchen Experiment (T420007)]] (duration: 07m 48s)

Quick question on the re-auth code. What happens when you try to make a sensitive API query but haven't re-authed recently? Does the API query silently fail? Is it unaffected by reauth?

In T419621#11827320, @Novem_Linguae wrote:

What happens when you try to make a sensitive API query but haven't re-authed recently? Does the API query silently fail? Is it unaffected by reauth?

My reading of the current mitigation is that it's just for editsitejs operations on actual MW pages with titles, see: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikimediaCustomizations/+/1271886/1/src/ForceReauth/ForceReauthHookHandler.php. Eventually, we do plan to support more varieties of sensitive operations and likely sensitive API requests.

@Novem_Linguae Assuming that you mean an API query that would edit a page that normally triggers reauthentication:

• If the authentication type used for the API query has the ability to reauth (e.g. cookies in a browser), then it will fail with the same error message as in T423193, until you reauthenticate while using the same auth session. If this is a gadget etc. running in your browser, you can reauth in another browser tab, and it'll succeed on the next try.
• If the authentication type used for the API query does not have the ability to reauth (e.g. OAuth, bot passwords), then it will always succeed. This is fine since those auth types can't be used from a browser that could be running malicious code.

This is already being enforced in the API? Ah I see. Confirmed with testing. Thanks for the clarification.

Hooks have been removed from PrivateSettings.php - https://sal.toolforge.org/log/VHnwl50B1kByGTxA1dA8

In T419621#11827741, @matmarex wrote:

If this is a gadget etc. running in your browser, you can reauth in another browser tab, and it'll succeed on the next try.

Once T208667: Tie reauthentication (login with elevated security) to a specific security level gets done, you'll need a hard-to-guess link to start reauthentication. We should probably include that in the error message (or say something like "visit the edit form from your browser to start the reauthentication process").

Also would be nice to return the security level in a machine-readable way in the error message.

Change #1281818 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/WikimediaCustomizations@master] ForceReauth: Improve permission error

https://gerrit.wikimedia.org/r/1281818

Change #1281818 merged by jenkins-bot:

[mediawiki/extensions/WikimediaCustomizations@master] ForceReauth: Improve permission error

https://gerrit.wikimedia.org/r/1281818