Page MenuHomePhabricator
Create Task
Maniphest T423193

Site JS editing experience when timeout happens mid-edit is poor
Open, HighPublicBUG REPORT
Actions

Description

Steps to replicate the issue (include links if applicable):

  • Start editing site JS
  • Wait long enough for your session to expire
  • Try to save

What happens?:

"You must log in again to verify that you are Pppery."

No way to do so other than opening the edit form again

What should have happened instead?:

Some way to verify your security status inline. Maybe a popup asking for a 2FA code ...

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):

Other information (browser name/version, screenshots, etc.):

Related Objects
Search...

Event Timeline

Pppery created this task.Apr 13 2026, 7:39 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 13 2026, 7:39 PM
Catrope triaged this task as High priority.Apr 13 2026, 9:19 PM
Catrope added a project: 2026-user-javascript-incident.
Catrope subscribed.

We will look into this as part of the work we're doing this quarter on improving the reauthentication system. We could mitigate this several different ways, for example:

  1. Show the same error as now, but also use JS to pop up a login form
  2. When the user hits the save button, stash the content they were trying to save, redirect to the login form for reauth, then redirect back to the edit form with the stashed content pre-populated

In the meantime, a workaround you can use when you see this error is:

Catrope added a parent task: T197160: All security-sensitive MediaWiki functionality should require elevated security.Apr 13 2026, 9:19 PM
A_smart_kitten added subscribers: Krinkle, A_smart_kitten.Apr 13 2026, 9:19 PM

See also @Krinkle's comment at T197137#11760351

Novem_Linguae subscribed.Apr 13 2026, 9:26 PM
MBH subscribed.Apr 13 2026, 11:55 PM
Johannnes89 subscribed.Apr 14 2026, 6:40 AM
Nirmos subscribed.Tue, Apr 14, 9:49 PM
Nirmos added a comment.Tue, Apr 14, 10:04 PM
In T423193#11817052, @Catrope wrote:
  • resubmit the edit

But there are no .editOptions buttons at all when this happens?

Catrope mentioned this in T197137: Editing sitewide JS/CSS pages should require elevated security.Wed, Apr 15, 8:52 PM
matmarex mentioned this in T419621: Move site JS reauth code out into WikimediaCustomizations.Thu, Apr 16, 12:03 AM
matmarex subscribed.Thu, Apr 16, 12:13 AM
In T423193#11822060, @Nirmos wrote:
In T423193#11817052, @Catrope wrote:
  • resubmit the edit

But there are no .editOptions buttons at all when this happens?

You can use the refresh button in your browser, and confirm that you really want to resubmit the form when it displays a prompt. (I tested this on Firefox and Chromium.)

Wellverywell subscribed.Thu, Apr 16, 3:52 AM
Nux subscribed.Thu, Apr 16, 9:22 AM
Bugreporter subscribed.Tue, Apr 21, 1:41 AM

Close this tab, go back to the tab with your edit session, and resubmit the edit

Note: in many browsers simply press F5 on "You must log in again to verify that you are XXX" error screen will try to resubmit the edit.

MGChecker subscribed.Sun, May 3, 5:18 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits