Page MenuHomePhabricator

TypeError: MediaWiki\Extension\OAuth\ResourceServer::getUser(): Return value must be of type MediaWiki\User\User, false returned
Closed, ResolvedPublicPRODUCTION ERROR

Description

Error
  • service.version: 1.46.0-wmf.19
  • timestamp: 2026-03-12T22:44:33.438Z
  • labels.phpversion: 8.3.30
  • trace.id: f707f90f-ccff-4013-b1e5-943b4282ab8a
  • Find trace.id in Logstash
labels.normalized_message
[{reqId}] {exception_url}   TypeError: MediaWiki\Extension\OAuth\ResourceServer::getUser(): Return value must be of type MediaWiki\User\User, false returned
FrameLocationCall
from/srv/mediawiki/php-1.46.0-wmf.19/extensions/OAuth/src/ResourceServer.php(97)
#0/srv/mediawiki/php-1.46.0-wmf.19/extensions/OAuth/src/SessionProvider.php(125)MediaWiki\Extension\OAuth\ResourceServer->getUser()
#1/srv/mediawiki/php-1.46.0-wmf.19/includes/Session/SessionManager.php(569)MediaWiki\Extension\OAuth\SessionProvider->provideSessionInfo(MediaWiki\Request\WebRequest)
#2/srv/mediawiki/php-1.46.0-wmf.19/includes/Session/SessionManager.php(137)MediaWiki\Session\SessionManager->getSessionInfoForRequest(MediaWiki\Request\WebRequest)
#3/srv/mediawiki/php-1.46.0-wmf.19/includes/Request/WebRequest.php(861)MediaWiki\Session\SessionManager->getSessionForRequest(MediaWiki\Request\WebRequest)
#4/srv/mediawiki/php-1.46.0-wmf.19/includes/Setup.php(504)MediaWiki\Request\WebRequest->getSession()
#5/srv/mediawiki/php-1.46.0-wmf.19/includes/WebStart.php(73)require_once(string)
#6/srv/mediawiki/php-1.46.0-wmf.19/api.php(23)require(string)
#7/srv/mediawiki/w/api.php(3)require(string)
#8{main}
Notes

Just noticed 115 of these in 1.46.0-wmf.19 (T413810), mostly for wikibooks wikis with a handful for larger wikis. Seems new in wmf.19.

Haven't been able to reproduce by spot-checking URLs.

Details

Request URL
https://en.wikipedia.org/w/api.php?action=opensearch&format=*&limit=*&namespace=*&search=*
Related Changes in Gerrit:

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript
brennen updated the task description. (Show Details)

Just remembered @Tgr deployed some OAuth stuff during the latest backport window - any thoughts?

(Also that broke getting an access token with client credentials, and this probably broke using an access token that was obtained with client credentials, so maybe one causes bots to retry more aggressively than the other.)

This is the snippet that sets ResourceServer::$user:

$userId = $request->getAttribute( 'oauth_user_id', 0 );
if ( !$userId ) {
	// Set anon user when no user id is present in the AT (machine grant)
	$this->user = User::newFromId( 0 );
	return;
}

$this->user = Utils::getLocalUserFromCentralId( $userId );

so apparently the value in sub is not empty but also not a valid ID. I guess the handling of the mw: prefix fails somehow? In general, we should make sure sub parsing fails in a safe way.

(Also we need to fix T418720: Logstash entries should include the application ID used for the request, it's hard to debug errors without knowing the details of the app that's causing them.)

Change #1251987 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/OAuth@master] Fix client credentials access tokens

https://gerrit.wikimedia.org/r/1251987

Change #1251987 merged by jenkins-bot:

[mediawiki/extensions/OAuth@master] Fix client credentials access tokens

https://gerrit.wikimedia.org/r/1251987

Change #1253623 had a related patch set uploaded (by Bartosz Dziewoński; author: Gergő Tisza):

[mediawiki/extensions/OAuth@wmf/1.46.0-wmf.19] Fix client credentials access tokens

https://gerrit.wikimedia.org/r/1253623

Change #1253623 merged by jenkins-bot:

[mediawiki/extensions/OAuth@wmf/1.46.0-wmf.19] Fix client credentials access tokens

https://gerrit.wikimedia.org/r/1253623

Mentioned in SAL (#wikimedia-operations) [2026-03-16T20:57:26Z] <catrope@deploy2002> Started scap sync-world: Backport for [[gerrit:1253623|Fix client credentials access tokens (T417278 T419921)]], [[gerrit:1253625|Enable $wgTrackMediaRequestProvenance on testwikis and beta cluster (T414338)]], [[gerrit:1253626|Configure $wgApiClientErrorSampleRate (T418957)]]

Mentioned in SAL (#wikimedia-operations) [2026-03-16T20:59:17Z] <catrope@deploy2002> matmarex, catrope: Backport for [[gerrit:1253623|Fix client credentials access tokens (T417278 T419921)]], [[gerrit:1253625|Enable $wgTrackMediaRequestProvenance on testwikis and beta cluster (T414338)]], [[gerrit:1253626|Configure $wgApiClientErrorSampleRate (T418957)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-03-16T21:05:37Z] <catrope@deploy2002> Finished scap sync-world: Backport for [[gerrit:1253623|Fix client credentials access tokens (T417278 T419921)]], [[gerrit:1253625|Enable $wgTrackMediaRequestProvenance on testwikis and beta cluster (T414338)]], [[gerrit:1253626|Configure $wgApiClientErrorSampleRate (T418957)]] (duration: 08m 06s)