MediaWiki may make API requests to other instances of MediaWiki, sometimes operated by different entities in different networks. It should be possible to authenticate such requests, to avoid issues with rate limits, and potentially also to allow cross-wiki access to certain information to be restricted.
Implementation note: Owner-only OAuth tokens provide a simple but effective mechanism to achieve this. However, for WMF sites, this by itself is not sufficient to benefit from improved rate limits. The client also needs to support cookies that persist between request.
Original Report
As the co-administrator of a MediaWiki that interacts with Wikimedia wikis, I want MediaWiki to comply with Wikimedia’s user agent policy, in order to have my wiki continue to work as Wikimedia enforces this policy more and more stringently.
As the WMF and WMDE, given that we want third-party wikis to exist {{citation needed}}[1], [2], we want released MediaWiki versions to be able to interact with Wikimedia wikis.
Problem:
Several places in MediaWiki make API requests to other wikis, often Wikimedia wikis, including:
- MediaWikiPageNameNormalizer, called by Site::normalizePageName(), e.g. when adding a sitelink to a Wikibase item
- ForeignAPIRepo, used by (I think) InstantCommons
However, they don’t allow site administrators to improve the API requests. MediaWikiPageNameNormalizer has a very poor user agent (ForeignAPIRepo’s is better since T400881), neither makes the user agent customizable (e.g. via a configuration variable), and it’s not possible to authorize the request in any way.
Previous discussion:
https://www.mediawiki.org/wiki/Talk:Wikimedia_APIs/Rate_limits#Wikipedia_sitelink_lookups_being_rate_limited_on_FactGrid