Page MenuHomePhabricator

Action API requests with centralauthtoken=… or OAuth bearer token should produce CORS headers if the token is invalid
Closed, ResolvedPublic

Description

Action API requests with centralauthtoken=… do not produce CORS headers if the token is invalid. Much like in T420280, this prevents client-side JavaScript code from handling the error.

The fact that no one complained about it in 12 years probably means that such errors almost never happen in practice, and we can freely change the response format.

To reproduce, visit e.g. https://www.mediawiki.org/ and run this in browser console:

CoreForeignApi = mw.ForeignApi.parent;
await new CoreForeignApi( 'https://test.wikipedia.org/w/api.php', { anonymous: true } ).get( {} ); // succeeds
await new CoreForeignApi( 'https://test.wikipedia.org/w/api.php', { anonymous: true } ).get( { centralauthtoken: 'asdf' } ); // fails with console errors about CORS; should fail with 'badtoken' or something like that

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

I think this also affects non-confidential OAuth 2 clients (running entirely in the browser) – related to T419034.

await new CoreForeignApi( 'https://mediawiki2.localhost/w/api.php', { anonymous: true } ).get( {}, { headers: { Authorization: 'Bearer asdf' } } ); // fails with console errors about CORS; should fail with 'mwoauth-invalid-authorization'

(this can't be reproduced on Wikimedia wikis due to the new gateway producing its own errors in this case, but I can reproduce locally)

Change #1264742 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/core@master] SessionProvider: Output CORS headers when throwing action API exception

https://gerrit.wikimedia.org/r/1264742

Change #1264743 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@master] SessionProvider: Output CORS headers when throwing action API exception

https://gerrit.wikimedia.org/r/1264743

Change #1264746 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@master] CentralAuthTokenSessionProvider: Use core code for exception-throwing sessions

https://gerrit.wikimedia.org/r/1264746

Change https://gerrit.wikimedia.org/r/1264742 fixes the bug for OAuth.

Either change https://gerrit.wikimedia.org/r/1264743 or https://gerrit.wikimedia.org/r/1264746 fixes the bug for CentralAuth (they depend on 1264742). The first is very simple, but inelegant, since it calls internal core methods. The second is a bigger rewrite to use the stable core methods.

daniel renamed this task from Action API requests with centralauthtoken=… do not produce CORS headers if the token is invalid to Action API requests with centralauthtoken=… should produce CORS headers if the token is invalid.Mar 31 2026, 10:48 AM

Change #1264742 merged by jenkins-bot:

[mediawiki/core@master] SessionProvider: Output CORS headers when throwing action API exception

https://gerrit.wikimedia.org/r/1264742

matmarex renamed this task from Action API requests with centralauthtoken=… should produce CORS headers if the token is invalid to Action API requests with centralauthtoken=… or OAuth bearer token should produce CORS headers if the token is invalid.Thu, Apr 16, 8:57 PM

Change #1264743 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] CentralAuthApiSessionProvider: Output CORS headers when throwing action API exception

https://gerrit.wikimedia.org/r/1264743