Steps to replicate the issue (include links if applicable):
- Disable third-party cookies
- Log out (not sure if this is actually necessary)
- Log back in at en.wikipedia.org,
- Make at least 1000 ForeignApi requests to en.wikitionary.org, e.g.:
let a = new mw.ForeignApi("https://en.wiktionary.org/w/api.php", {ajax:{headers:{'Api-User-Agent':"Rate Limit Test (User:MyUserName)"}}});
let r = () => ({action:"query",requestid:Math.random()});
for(let i = 0; i < 400; i++)
console.log(i, await Promise.all([a.get(r()),a.get(r()),a.get(r())]))What happens?:
Works for a while then:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://en.wiktionary.org/w/api.php?action=query&format=json&origin=https%3A%2F%2Fen.wikipedia.org¢ralauthtoken=...&requestid=0.815467728280899. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 429.
What should have happened instead?:
All requests succeed. There are currently no limits on authenticated browser traffic, and any future limits will be much greater than 1000 anyway. I am using a browser, and centralauthtoken is a form of authentication.
This is contrived, of course, but see https://www.mediawiki.org/wiki/Talk:Wikimedia_APIs/Rate_limits#Script-using_humans_are_not_bots where @Tom.Reding apparently tripped this bug in course of normal work.
